In 2017, the Indian Supreme Court, in a landmark judgment (the “Puttaswamy Judgement”), found privacy to be a fundamental right granted to every person under the Indian Constitution. The right was read into the right to life and personal liberty granted under Article 21.
Fundamental rights, however, while enforceable against the state, are not necessarily so against private entities or individuals.1 This created a need for a robust legislation setting out provisions on data protection for data subjects and data fiduciaries in India. In the Puttaswamy Judgement, reference was made to an Expert Group which had published a Report in 2012 regarding a framework for protection of privacy concerns which would expectedly be used to draft a legislation for India’s data protection regime. Additionally, the Puttaswamy Judgement also referred to a memorandum submitted by the Government where the Government had constituted a Committee to review data protection norms and make recommendations. In light of these, the Puttaswamy Judgement stated that it would be appropriate for this committee to make determinations for putting in place a robust data protection regime and called upon the Government to take all necessary steps to put such a law in place.
The Committee constituted in 2017, chaired by Justice BN Srikrishna, presented the Draft Personal Data Protection Bill, 2018 to the Ministry of Electronics and Information Technology (“MeitY”), which was then further amended and formed the Personal Data Protection Bill, 2019 (“PDPB 2019”).