India’s data protection law is usually argued about as if it began with the statute that carries the name. It did not. For most of the period in which the argument ran, the only operative data protection regime in the country was a set of rules made in 2011 under a compensation provision of the technology statute, written for a narrower problem and never designed to carry the weight that practice loaded onto them. The statute arrived in August 2023, twelve years after those rules, six years after the Supreme Court recognised privacy as a fundamental right, and five years after a committee of experts produced a draft Bill of a very different character from the one that eventually passed. Between the first draft and the Act stand a second draft that reached Parliament, a joint committee that rewrote much of it, a withdrawal on the floor of the House, and a fourth draft that abandoned a large part of the design the process had spent years assembling.

That succession is the subject of this article, and it is best read as a record of omissions. Each version of the project dropped something the previous version had contained, and the items dropped were not details. A classification of sensitive and critical personal data with heightened obligations disappeared. Requirements that copies of personal data be stored within India disappeared. A right to move one’s data from one service to another disappeared, and a right to have it cease to be disclosed disappeared with it. An express exemption for journalistic work, present in two successive drafts, disappeared from the Act, so that reporting was left inside a consent-based statute with no carve-out of its own. A mechanism by which an individual who suffered harm could recover compensation disappeared, replaced by penalties payable to the State. An enforcement authority designed with an independent selection process was replaced by a Board appointed by the Central Government. Reading the drafts in sequence, in the order the drafting choices were made, explains the enacted statute better than reading the statute alone, because the Act is in large measure what remains after those choices.

There is a practical reason, beyond completeness, for setting the sequence out in this form. Indian courts construe ambiguous statutory language against the background of the material that produced it, and committee reports and drafting history are part of the record advocates reach for when a provision is challenged. The provisions of this Act that will be litigated are identifiable in advance: the notification exempting State instrumentalities, the absence of a compensation route, the amendment of the transparency statute. When those challenges come, the question a court will be asked is whether the enacted choice was a considered one. The drafting history answers that question in documentary form. It shows that narrower exemptions were drafted and rejected, that a compensation mechanism existed in two successive texts and was removed, and that the transparency amendment was made in a statute whose own subject was something else. A legislative history is the place where that record is assembled while it can still be assembled accurately, and that is the service this article is intended to perform for the litigation and the scholarship that will follow.

The sequence also has a distinction no other subject in this series can claim. The series has documented Bills that were withdrawn, Bills that lapsed, and Acts that were passed and then left uncommenced for years. The data protection project contains all three failure modes inside a single story. A committee draft was never introduced. An introduced Bill was examined for two years and then withdrawn. An enacted Act was left to wait for rules, and when the rules arrived they staged its commencement so that its central obligations bind only in 2027. A reader who understands how that happened understands something general about how a legislative programme moves in India: slowly at the stage of design, quickly at the stage of passage, and slowest of all at the stage where obligations begin to bite.

A data protection law in outline: the decade in one view

The chronology is short enough to state in a single passage, and stating it plainly is the quickest way to see what needs explaining.

In April 2011 the Central Government notified the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, made under section 43A of the Information Technology Act, 2000. Those rules defined sensitive personal data, required consent for its collection, required a published privacy policy and a grievance officer, and attached compensation liability to negligent handling. They were, and for a long period remained, the whole of Indian data protection law in operation.

In October 2012 a Group of Experts on Privacy, constituted by the Planning Commission and chaired by Justice A. P. Shah, a former Chief Justice of the Delhi High Court, submitted its report. It proposed nine national privacy principles and a privacy statute enforced by privacy commissioners. No Bill followed from it.

In July 2017 the Ministry of Electronics and Information Technology constituted a committee of experts under the chairmanship of Justice B. N. Srikrishna, a retired judge of the Supreme Court, to study data protection and suggest a draft law. In August 2017, weeks after that committee was formed, a nine-judge bench of the Supreme Court held in Justice K. S. Puttaswamy (Retd.) v Union of India that privacy is a fundamental right. In July 2018 the Srikrishna Committee submitted its report, titled A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians, together with a draft Personal Data Protection Bill.

In December 2019 the government introduced its own version, the Personal Data Protection Bill, 2019, in the Lok Sabha. The House referred it the same day to a joint committee of both Houses. The committee, after extensions spread across two years, reported on 16 December 2021, recommending eighty-one amendments, twelve further recommendations, and a change of name to the Data Protection Bill because it proposed to regulate non-personal data as well. On 3 August 2022 the government withdrew the Bill. In November 2022 it published a fresh and much shorter draft, the Digital Personal Data Protection Bill, for public consultation. That draft, revised, was introduced in the Lok Sabha on 3 August 2023, passed by that House on 7 August and by the Rajya Sabha on 9 August, and received the President’s assent on 11 August 2023. It became the Digital Personal Data Protection Act, 2023. Draft rules under it were published for consultation in January 2025 and the final Rules were notified in November 2025, with commencement staged so that the principal obligations on those who process personal data take effect in May 2027.

Two features of that outline should be fixed before the detail begins, because commentary habitually gets both wrong. The first is that the drafts were not successive versions of one Bill in any formal sense. Only one of the four texts was ever a Bill before Parliament. The 2018 text was a committee’s proposal, the 2021 text was a committee’s redraft attached to a report, and the 2022 text was a consultation paper; each was written from the one before, but none inherited any parliamentary status from it, and the government was free at every stage to take as much or as little of its predecessor as it chose. The second is that the movement between versions was not a general tightening or loosening. The obligations owed by private processors to individuals were argued about in both directions, and some survived intact through every version. What moved in one direction only, at every stage without exception, was the treatment of the State as a processor, the independence of the body meant to enforce the law, and the individual’s entitlement to be paid when harmed. A reader who watches those three threads can follow the whole decade without a chart.

Counted from the recognition of the right in August 2017 to the first substantive obligation in 2027, the interval is ten years. Counted from the rules of 2011, it is sixteen. The claim this article wants a reader to be able to test is that the decade was not spent failing to draft a law. Four complete drafts were produced, and the differences among them were the product of identifiable decisions about the State, about industry cost, about where data should be stored, and about who should be compensated when things go wrong. The omissions are the story, and they are documented in the texts themselves.

The regime that never left: sections 43A and 72A and the Rules of 2011

Every later draft was written against a working regime, and the working regime shaped what the drafts were expected to fix. It rested on two provisions of the Information Technology Act, 2000, both inserted by the amendment of 2008 and brought into force on 27 October 2009.

Section 43A is a compensation provision. Where a body corporate possessing, dealing in or handling sensitive personal data or information in a computer resource it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and procedures, and that negligence causes wrongful loss or wrongful gain to any person, the body corporate is liable to pay damages by way of compensation to the person affected. The provision is narrow in three ways. It reaches bodies corporate, not the State. It is triggered by negligence in security practices, not by unlawful processing generally. And it compensates; it does not regulate in advance. Section 72A is the criminal companion: disclosure of information in breach of a lawful contract, with intent to cause or knowing it is likely to cause wrongful loss or wrongful gain, is punishable with imprisonment of up to three years, or a fine of up to five lakh rupees, or both.

What is the difference between a rule, a draft Bill and an Act in this sequence?

A rule is delegated legislation made by the executive under a power an Act already contains, and it binds from notification. A draft Bill is a proposal with no legal force. An Act is a Bill passed by both Houses and assented to by the President, though its provisions bind only from the commencement dates notified.

Two neighbouring provisions complete the picture of what the technology statute offered on privacy before 2011. Section 43 made a person who, without permission, accesses a computer resource, downloads or copies data, or damages a system liable to pay damages to the person affected, a general computer-misuse compensation provision of which data theft formed part. Section 66E, also a product of the 2008 amendment, created an offence of intentionally capturing, publishing or transmitting the image of a private area of a person without consent, in circumstances violating that person’s privacy, punishable with imprisonment of up to three years, or a fine of up to two lakh rupees, or both. Between them, sections 43, 43A, 66E and 72A were the statute’s entire privacy content: two compensation provisions, one of them tied to security negligence, and two offences, one tied to images and one to breach of contract. There was no provision addressed to the ordinary, lawful-seeming processing of personal information by a company or a government department acting within its powers, which is the subject data protection law exists to govern. The drafts that followed were attempts to legislate for that ordinary case, and their difficulty in doing so is the difficulty of a legislature writing, for the first time, rules for conduct that had never been unlawful.

The provision was incomplete on its face, because the two expressions that did the work in it, sensitive personal data or information and reasonable security practices and procedures, were left undefined in the Act. The Rules of 2011, notified on 11 April 2011 as G.S.R. 313(E), supplied the definitions and built a small regime around them. Rule 3 listed the categories treated as sensitive: passwords; financial information such as bank account, credit card, debit card and other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; and biometric information, with a residual category for information received under those heads and stored or processed under lawful contract. Rule 4 required a body corporate collecting information to publish a privacy policy covering the type of information collected, the purpose of collection, and its disclosure practices. Rule 5 required consent in writing, including by electronic record, before collection of sensitive information, limited collection to a lawful purpose connected with the collector’s function, allowed the provider of information to review and correct it, and required a grievance officer whose name and contact details were to be published and who was to redress grievances within a month. Rule 8 treated documented information security programmes and practices, including the IS/ISO/IEC 27001 standard or approved industry codes, as reasonable security practices.

The August 2011 clarification issued by the Ministry narrowed the apparent reach: the Rules were explained to apply to a body corporate or person located in India, and service providers handling sensitive information under contract for others were relieved of the consent collection obligation that the text had appeared to impose on them. That clarification, issued within months of notification, is an early instance of a pattern that recurs throughout the decade, in which a text announced at one width operated at a narrower one.

The rest of the Rules filled out a modest but recognisable regime. Disclosure of sensitive information to a third party required the prior consent of the provider of the information, subject to exceptions for legal obligation and for sharing with government agencies mandated under law. Transfer of sensitive information to another body corporate was permitted where it was necessary for the performance of a lawful contract with the provider or where the provider had consented, and only to a recipient ensuring the same level of protection the Rules themselves prescribed. Retention was limited to the period required for the lawful purpose or by law. Enforcement ran entirely through section 43A itself: a person claiming wrongful loss or gain from negligent security practice took the claim to the adjudicating officer appointed under the technology statute, an officer of the very government whose own processing stood outside the provision, with appeals lying to the appellate tribunal the statute provided. There was no inspectorate, no audit power, no code of practice and no public register of decisions from which a practice could develop. The regime’s thinness was therefore institutional as much as textual. It gave an individual a claim after the event and gave nobody the job of preventing the event, and in the outsourcing economy for which it was largely written, the compensation claim was rarely the instrument anyone reached for. Contracts did the work the statute did not, and the privacy policies the Rules required became the operative documents, drafted by the collectors they were meant to restrain.

What the 2011 regime did not contain is as significant as what it did. It created no regulator. It conferred no right of access, correction or erasure enforceable against the world at large; the review right in the Rules ran through the collector’s own grievance officer. It imposed no obligation to notify anyone when a breach occurred. It said nothing about children, nothing about transfer of data outside India beyond a consent and equivalent-protection condition, and nothing at all about processing by government agencies, which stood outside section 43A’s body corporate frame. It was, in substance, a security and consent code for companies, attached to a compensation claim, at a moment when the largest processor of personal information in the country was becoming the State itself, through the identity programme then being built.

Yet the regime mattered, and continued to matter long after its inadequacy was universally conceded, for a simple institutional reason: it was the only regime there was. When the Srikrishna Committee reported in 2018, the Rules had been in force for seven years. When the Act was passed in 2023, they had been in force for twelve. When its obligations begin to bind in 2027, the Rules will have governed Indian data processing for sixteen years, under a provision of a statute principally concerned with electronic commerce and computer misuse. The Act itself acknowledges the lineage by providing, in its amending section, for the omission of section 43A from the technology statute, so that the compensation provision around which the 2011 Rules were built leaves the statute book as the new framework takes its place. The legislative history of Indian data protection is therefore not a story of a vacuum followed by a statute. It is a story of a provisional regime that outlasted four attempts to replace it.

The first blueprint: the group of experts of 2012

The first attempt to design a privacy law for India came not from the ministry that would later own the subject but from the Planning Commission, which constituted a Group of Experts on Privacy under the chairmanship of Justice A. P. Shah. The immediate provocation was administrative rather than judicial. The State was assembling large databases of personal information, the unique identity programme among them, and there was no statute stating the principles on which such collection rested or the remedies available when it went wrong. Earlier drafts of privacy Bills had circulated without being introduced, and a concept paper had been prepared within government in 2010, but no text had been placed before Parliament.

The Group submitted its report to the Planning Commission on 16 October 2012. Its central deliverable was a set of nine national privacy principles, drawn from international practice and adapted to Indian conditions: notice; choice and consent; collection limitation; purpose limitation; access and correction; disclosure of information; security; openness; and accountability. Around those principles the report proposed a framework of privacy commissioners at the Centre and in the regions, working with self-regulatory organisations of industry in a co-regulatory structure, and a privacy statute of general application covering the public and the private sector alike.

The principles were not slogans; each carried an operational consequence the report spelt out. Notice meant that a collector had to tell the individual, before collection, what was being collected and why. Choice and consent meant the individual could refuse, and could withdraw. Collection limitation confined the collector to what the stated purpose required, and purpose limitation confined the use to that purpose, so that data gathered for a welfare scheme could not migrate silently to a policing use. Access and correction gave the individual a right to see the record and have it put right. Disclosure of information governed onward transfer. Security imposed safeguards proportionate to sensitivity. Openness required the collector’s practices to be public, and accountability placed responsibility on a named office rather than on the organisation in the abstract. The report also addressed the hard cases directly, listing the exceptions it regarded as legitimate, among them national security, public order, disclosure in the public interest, and the prevention, detection, investigation and prosecution of offences, and treating historical and scientific research and journalistic purposes as candidates for exception as well. That list is worth noticing in a legislative history, because the journalistic exception which disappeared from the statute in 2023 was present in the design conversation from 2012 onwards, and disappeared late.

Two features of the report matter for the later history. The first is that its principles survived everything that followed. Notice, consent, purpose limitation, access and correction, security and accountability reappear as the organising ideas of the Srikrishna report six years later and as the stated principles of the Rules of 2025, which rest on consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. The vocabulary of Indian data protection was settled in 2012, and it settled early. The second feature is what the report could not do. A group of experts constituted by the Planning Commission could recommend; it could not introduce a Bill, and no ministry took the report up as the basis of one. Between October 2012 and July 2017 the principles existed as an agreed design with no legislative vehicle attached to them. The lesson, which the decade repeats, is that in this field the drafting of a framework and the decision to legislate are separate events, and the second does not follow from the first.

The judgment that made a statute necessary

The event that converted an agreed design into an obligation was judicial. The constitutional challenge to the Aadhaar programme had produced a reference on the prior state of the law: smaller benches of the Supreme Court had spoken of privacy as protected without settling its status, and the question whether the Constitution recognises a fundamental right to privacy was placed before a bench of nine judges. On 24 August 2017 that bench answered unanimously that it does. The judgment in the Puttaswamy case, which owns the reasoning of the privacy verdict in this series, held that privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms guaranteed by Part III of the Constitution, and that it includes informational privacy, the interest an individual has in controlling information personal to them.

The bench had been assembled because the earlier case law pointed both ways. Decisions of the 1950s and 1960s, in M. P. Sharma v Satish Chandra and Kharak Singh v State of Uttar Pradesh, had been read for decades as denying that the Constitution contained a general right to privacy, while a line of smaller-bench decisions from the 1970s onwards had protected aspects of privacy without displacing those readings. The Aadhaar challenge forced the question, a three-judge bench referred it in 2015, and the nine-judge bench was constituted to settle it. The significance for the legislative history is that the Court did not merely add a right to the list. It overruled the contrary readings of the older cases to the extent necessary, which meant that from 24 August 2017 every exercise of State power over personal information, including the identity programme whose challenge had produced the reference, had to be justified against a fundamental right that the State’s own older authorities had said did not exist.

The legislative consequence is the part that belongs to this article, because it is the origin of everything drafted afterwards. The opinions treated a statutory framework for data protection as the appropriate institutional response to the right they had recognised. Infringements of privacy by the State were to be tested against legality, legitimate aim and proportionality, and a data protection law was the natural instrument through which the legality limb would ordinarily be supplied for systematic processing. The government of the day had itself proceeded on that footing before the Court: the committee of experts under Justice Srikrishna had been constituted on 31 July 2017, while the reference was under hearing, and the Attorney General had pointed to the committee’s work in argument. The judgment therefore did not start the drafting process. It changed the drafting process’s legal character. A committee that had been a policy exercise when constituted in July became, by the end of August, the machinery for discharging a constitutional expectation, and the report it produced would be read from then on as the draft of a statute that a fundamental right required, not merely one that a ministry fancied.

One strand of the opinions deserves separate mention because it is the strand the drafting process picked up. Justice Kaul’s concurring opinion addressed the digital dimension directly, observing that individuals leave trails of personal information in the course of ordinary life online, that the aggregation of such information creates profiles of a completeness no single disclosure would produce, and that the growth of non-State actors holding such information made a statutory regime for data protection a matter of constitutional as well as policy importance. The plurality opinion likewise treated the existence of a data protection law as relevant to the validity of State action touching informational privacy. A committee drafter reading the judgment in the autumn of 2017 therefore had judicial warrant, from more than one opinion, for treating the statute in preparation as part of the constitutional settlement rather than as ordinary sectoral regulation.

That change of character explains both the ambition of the 2018 draft and the bitterness of the argument that followed its dilution. A Bill that is the statutory expression of a fundamental right is judged by a different standard from a Bill that is a market regulation measure. The Srikrishna Committee wrote to the first standard. The texts that followed it were progressively written to the second, and the distance between the two standards is the distance this article is measuring.

The Srikrishna draft of 2018: the maximalist text

The committee constituted on 31 July 2017 had ten members and a double brief: to identify the key questions of data protection in India and to suggest a draft law. Justice B. N. Srikrishna, its chairman, was a retired judge of the Supreme Court. The committee proceeded by a white paper and public consultation before it reported, and on 27 July 2018 it submitted its report to the Minister for Electronics and Information Technology together with a complete draft statute, the Personal Data Protection Bill, 2018.

The report’s organising idea was fiduciary. The relationship between an individual and an entity that processes the individual’s personal data was analysed as a relationship of trust governed by duties, on the model of the relationships the law already treats as fiduciary. From that idea the draft took its enduring vocabulary. The individual is the data principal, the person to whom the personal data relates. The entity that determines the purpose and means of processing is the data fiduciary. Those two expressions appear in every subsequent version and in the enacted Act, and they are the committee’s permanent contribution to the statute book, surviving the removal of most of what the committee built around them.

When did the expression data fiduciary enter Indian lawmaking?

In the draft Bill submitted by the Srikrishna Committee on 27 July 2018. The committee analysed the relationship between an individual and a processor of that individual’s data as a fiduciary relationship of trust, named the individual the data principal and the processor the data fiduciary, and both expressions passed through every later draft into the Act.

Was the draft Bill of 2018 ever introduced in Parliament?

It was not. It was a committee’s draft, submitted to the Ministry of Electronics and Information Technology with the committee’s report, and no minister introduced it in either House. The government considered it for over a year, altered it in respects its authors had not proposed, and introduced its own version in December 2019, which is a different Bill.

The draft itself was the most demanding text of the four the decade produced. It divided personal data into tiers. Ordinary personal data attracted the general obligations. Sensitive personal data, a defined list running from passwords and financial data through health data, sexual orientation, biometric and genetic data to caste or tribe and religious or political belief or affiliation, attracted heightened duties, including explicit consent. A third tier, critical personal data, was to be notified by the Central Government, and it attracted the draft’s hardest rule. The draft required every data fiduciary to store at least one serving copy of all personal data on a server or data centre located in India. Sensitive personal data could be transferred outside India only on stated conditions, including the consent of the data principal and approved contractual terms, and was to continue to be stored in India. Critical personal data could be processed only in India.

The rights chapter was equally full. It gave the data principal rights to confirmation and access, to correction and erasure, to data portability, the right to receive the data the principal had provided in a structured and machine-readable form and to transmit it, and a right to restrict or prevent continuing disclosure of personal data where it had served its purpose or consent had been withdrawn, the measure usually called the right to be forgotten, to be granted through an adjudicating officer. It imposed specific duties for the data of children, including a bar on profiling, tracking and behavioural monitoring of children and on targeted advertising directed at them. It created offences and a penalty structure keyed to worldwide turnover. And it allowed a data principal who had suffered harm as a result of a contravention to claim compensation from the fiduciary or processor responsible, which made the draft the only version in which the person harmed was the person paid.

Its institutional design matched its substantive ambition. It established a Data Protection Authority of India as an independent regulator with powers of inquiry, enforcement and code-making. Appointments to it were to be made on the recommendation of a selection committee chaired by the Chief Justice of India or a judge of the Supreme Court nominated by the Chief Justice, sitting with the Cabinet Secretary and an expert nominee. Security of tenure and protection of service conditions were written in. Its provisions on State processing were the most restrictive of any version: processing for the security of the State was permitted only where it was authorised by a law made by Parliament, carried out in accordance with the procedure that law established, and necessary and proportionate to the interest sought to be achieved, a formulation that wrote the privacy judgment’s own test into the exemption.

The committee had not worked in private. It published a white paper in November 2017 setting out the questions it proposed to answer, invited public responses, and held consultations before drafting, and its report recorded the consultation as part of its authority for the design it chose. Its enforcement design was as considered as its substantive one. Complaints and compensation claims were to be decided in the first instance by adjudicating officers under the Authority, with appeals to an appellate tribunal, so that an individual with a grievance faced a specialised forum rather than a civil court. Its penalty structure was two-tiered and turnover-based: the gravest contraventions, including failures of the obligations owed in respect of sensitive data and of children, attracted penalties of up to fifteen crore rupees or four per cent of the total worldwide turnover of the preceding financial year, whichever was higher, and other contraventions a lower band of five crore rupees or two per cent. Turnover-based penalties are a deliberate choice about who the statute is aimed at. A fixed sum that deters a start-up is a rounding error to a global platform; a percentage of worldwide turnover is the only figure that scales to both, and its disappearance from the enacted Act, in favour of fixed sums, is one of the quieter changes in the sequence. The draft’s treatment of the grounds of processing shows the design working. Consent was the primary ground, but the draft recognised processing without consent for functions of the State in providing services and benefits, for compliance with law and with court orders, for prompt action in medical emergencies and threats to public health, and for purposes of employment, each ground hedged with conditions rather than stated at large. It required a data fiduciary suffering a personal data breach to notify the Authority, and it created a class of significant data fiduciaries, identified by the volume and sensitivity of the processing they undertook, who would carry additional duties of audit, impact assessment and registration. It also recommended amendments beyond its own Bill, proposing changes to the Aadhaar statute and to other laws whose information practices the new framework would touch, which is the act of a committee that expected its report to be the beginning of a legislative programme rather than a single Bill.

The committee also addressed the transparency statute, which later versions handled very differently. Rather than rewriting the personal information exemption of the Right to Information Act, 2005 outright, the committee proposed amending it so that the circumstances in which disclosure of personal information is a proportionate interference with privacy would be stated in the law, harmonising the two statutes instead of subordinating one to the other.

The Bill of 2019: the government’s redraft

The government took sixteen months over the committee’s draft, and the Bill it introduced in the Lok Sabha on 11 December 2019, through the Minister of Electronics and Information Technology, Ravi Shankar Prasad, was recognisably descended from the draft and materially different from it. The differences, itemised at the time by commentators who compared the texts clause by clause, established the pattern that the rest of the history follows: the architecture survived, the constraints on the State and the entitlements of the individual were thinned.

The introduction itself was contested, and the contest set the terms on which the Bill spent its parliamentary life. Members of the opposition objected at the threshold that a Bill whose exemption clause allowed the government to take its own agencies outside the statute, on its own satisfaction, was inconsistent with the proportionality discipline of the privacy judgment, and that a measure of that consequence should not be taken up without examination. The reference to a joint committee of both Houses, moved and adopted on the day of introduction, was the government’s answer, and it had a double effect that the rest of the history illustrates. It conceded the principle that the text required scrutiny, which the objectors had established. And it moved the argument out of the chamber and into a committee room for two years, at the end of which the government was able to say that the examined text was no longer the text it wished to enact.

The tiers survived, and so did the structure of obligations, rights and penalties. Data portability and the right to restrict continuing disclosure survived. The compensation claim survived, routed through adjudicating officers under the Authority. The penalty ceiling for the gravest contraventions stood at fifteen crore rupees or four per cent of worldwide turnover, whichever was higher. Localisation survived in modified form. The requirement of a serving copy of all personal data in India was dropped; in its place, sensitive personal data could be transferred outside India on conditions, including explicit consent, but was to continue to be stored in India, and critical personal data, still a category to be notified by the Central Government, was to be processed only in India.

Two changes were of a different order. The first concerned the exemption for the State. Where the 2018 draft had confined security processing to action authorised by law, procedurally regulated, necessary and proportionate, section 35 of the 2019 Bill empowered the Central Government, where satisfied that it was necessary or expedient in the interest of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order, or for preventing incitement to the commission of a cognisable offence relating to those matters, to direct by order, for reasons recorded in writing, that all or any of the provisions of the Act should not apply to any agency of the Government. The statutory test was replaced by executive satisfaction. Justice Srikrishna responded in terms that were widely reported: he told The Economic Times that the provision was dangerous, that the safeguards had been removed, and that a law in that form could turn India into an Orwellian State. He wrote to the joint committee afterwards with his concerns, and he objected in the same terms to the redesign of the Authority, saying that the new structure put the body in the government’s hands and carried the probability of its becoming a government stooge, where the ideal was a constitutional authority on the model of the Election Commission.

The second change was that redesign. The 2019 Bill retained a Data Protection Authority with a chairperson and six members, but the selection committee that recommended appointments was reconstituted as a committee of officials, chaired by the Cabinet Secretary and sitting with the secretaries of the legal affairs and electronics and information technology departments. The judicial presence in the selection process, which the 2018 draft had treated as the guarantee of the regulator’s independence, was removed before the Bill reached a committee of Parliament.

One provision of the 2019 Bill had no ancestor in the committee’s draft and no descendant in the Act, and it deserves its own paragraph because it pointed the project in a direction the joint committee later took up. Section 91 empowered the Central Government, for the purpose of framing policy for the digital economy and for the State’s own planning, to direct any data fiduciary or processor to provide non-personal data, and anonymised personal data, to the government. The clause treated data held by private processors as a resource on which the State had a call, and it was criticised at introduction as converting a privacy statute into an instrument of data access for the State. It did not survive the withdrawal. But the idea that non-personal data belonged inside the data protection framework, which entered the project through that clause, is the idea the joint committee adopted when it proposed to rename the Bill and regulate both kinds of data together, and the episode shows how a provision can be dropped while its premise advances.

The Bill’s treatment of children carried the committee’s design forward: the personal data of a child, defined by the age of eighteen, was to be processed only with the consent of a parent or guardian, and data fiduciaries were barred from profiling, tracking and behavioural monitoring of children and from directing targeted advertising at them. Its offences included the re-identification of de-identified personal data without consent, punishable with imprisonment. Its financial penalties were two-tiered, with the higher band, fifteen crore rupees or four per cent of worldwide turnover, reserved for the gravest contraventions, and a lower band of five crore rupees or two per cent for failures of obligation. Those figures matter to the comparison because the Act replaced the turnover-based scale altogether with fixed sums in a Schedule, a change in the philosophy of deterrence that passed with little of the attention given to the exemptions.

The Bill also contained provisions the committee’s draft had not. It provided for the classification of significant data fiduciaries, a class that expressly included social media intermediaries above a notified threshold of users, and it provided for such intermediaries to offer users a mechanism for voluntary verification of their accounts, a proposal that drew objections as a step towards linking online speech to verified identity. It contained, in section 36, an exemption chapter for specified purposes, among them processing necessary for or relevant to a journalistic purpose, provided the processing complied with a code of ethics issued by the Press Council of India or a media self-regulatory organisation. That clause matters to the later history out of proportion to its length, because it is the last appearance of the journalistic exemption in the project. It was in the Bill that went to committee. It was not in the Act that came back.

Two years with the joint committee

The Lok Sabha referred the Bill on the day of its introduction to a joint committee of both Houses, a committee of thirty members drawn from both Houses, and the committee stage that followed was the longest and most consequential in the project’s life. Its sittings ran through the disruption of the pandemic years, which accounts for part of the two years it took, though not for all of it: the committee was examining a Bill whose sponsoring ministry was simultaneously revising its own position on several of the questions before it, and the record of extensions is in part a record of that movement. It heard the ministries whose agencies would be exempted by the Bill it was examining, the regulators whose fields it touched, the industry that would bear its costs and the organisations that spoke for the individuals it was meant to protect, and it took the unusual step, for a committee examining a government Bill, of treating the text as open in principle rather than as settled in everything except detail. The committee was first chaired by Meenakashi Lekhi and, after she entered the Council of Ministers, by P. P. Chaudhary. It took evidence from ministries, regulators, technology companies, civil society organisations and experts, and it obtained extension after extension, six in all, before reporting. The examination of a Bill by a committee of both Houses is the stage at which Parliament does its closest textual work, and the machinery is described in the article on parliamentary committees and the scrutiny of Bills.

The report was presented on 16 December 2021, two years and five days after introduction. It proposed eighty-one amendments to a Bill of ninety-nine sections and twelve further recommendations, and it attached a redrafted text, the Data Protection Bill, 2021. The scale of the amendment is the fact to hold onto, because it became the government’s stated reason for abandoning the Bill altogether: a committee asked to examine a text had returned something close to a new one.

The committee’s best-known recommendation was expansion. Finding that a clear demarcation between personal data and non-personal data was not possible in practice, and that a single regulator should oversee both, it proposed that the Bill regulate non-personal data as well, that the two be governed within one enactment, and that the title therefore drop the word personal and become the Data Protection Bill. It also proposed a clause preserving the Central Government’s power to frame policy for the digital economy, including the handling of non-personal data, which critics read as allowing executive policy to run behind the statute the committee was itself drafting. Members of the committee filed notes of dissent, directed principally at the breadth of the exemptions available to the State and at the composition and independence of the regulator.

On the merits, the committee’s direction was not uniformly towards dilution, and the record should be stated fairly. It recommended that the exemption of government agencies under the clause corresponding to section 35 be exercisable only in accordance with a procedure that was just, fair, reasonable and proportionate, importing into the exemption a discipline the introduced Bill had not contained. On localisation it moved the other way from the government’s later course: it recommended that a mirror copy of sensitive and critical personal data already held by foreign entities be brought to India, and that sensitive personal data not be shared with a foreign government or agency without the approval of the Authority. It retained data portability, the restriction on continuing disclosure, the compensation route and the tiered classification of data. Had the committee’s text been enacted, India would have had a statute wider in scope than the Bill introduced, covering non-personal data, stricter on the storage of sensitive data, and somewhat more demanding in the procedure for exempting the State.

The committee ranged beyond the text it had been given. It recommended that the government frame a policy for the certification of hardware and software products that deal with personal data, treating the devices and programmes through which data is collected as part of the protection problem. It addressed social media platforms directly, observing that their treatment as intermediaries under the technology statute did not make them accountable for the content they carried, and recommending a stronger accountability framework for them. It adjusted the consent architecture and the treatment of children’s data, and it recommended that the regulator handle both personal and non-personal data so that no separate enactment for the latter would be needed. Read as a whole, the report is not the document of a committee trying to kill a Bill by amendment. It is the document of a committee that believed the Bill was too narrow for its subject, and set out to widen it. That reading makes the government’s response harder, not easier, to characterise as forced by the committee’s conduct: a government confronted with a wider Bill it disliked had the ordinary options of accepting, negotiating or amending on the floor, and it chose none of them.

What became of those recommendations is the point. None of them was enacted. The committee reported in December 2021; the government neither moved the Bill for consideration nor announced its intentions for it during the sessions that followed, and the text the committee had spent two years producing joined the 2018 draft in the category of fully worked legislative designs that were never put to a vote.

Withdrawal, and the shorter draft that followed

On 3 August 2022 the Minister of Electronics and Information Technology, Ashwini Vaishnaw, moved and obtained the leave of the Lok Sabha to withdraw the Personal Data Protection Bill, 2019. His statement of reasons, circulated to members, was precise about the ground: the joint committee had proposed eighty-one amendments and twelve recommendations towards a complete legal framework for the digital ecosystem; considering that report, such a framework was being worked upon; it was therefore proposed to withdraw the Bill and present a new one that fitted the framework. In remarks reported the same day he put the arithmetic plainly, that eighty-one amendments in a Bill of ninety-nine sections amounted practically to rewriting the entire Bill.

Why does the withdrawal of a Bill differ from a Bill lapsing?

A Bill lapses by operation of the rules when the House that holds it is dissolved, without any decision being taken on it. A withdrawal is a deliberate act: the member in charge seeks the leave of the House and takes the Bill off its agenda, usually because the government intends to replace it.

The reasons the record gives are therefore of two kinds, and a legislative history should keep them apart. The formal reason is the one the Minister stated, and it is not a pretext in the trivial sense: the committee’s amendments really were extensive, they really did expand the Bill into non-personal data, and enacting them would have required the government to accept a statute substantially redesigned by a committee. The substantive reason is visible in the sequence of events. Nothing in the committee’s report compelled withdrawal; governments routinely accept committee amendments, resist them on the floor, or bring their own amendments to a reported Bill. The choice to start again, rather than to fight for the introduced text or adopt the reported one, indicates that the government preferred a different kind of statute from either, and that impression is confirmed by what it produced next.

The interval between report and withdrawal supports that reading. In the months after December 2021 the Bill was not debated, and the argument about it moved to correspondence. Industry bodies and large technology companies wrote to the Ministry in 2022 urging, among other things, that the treatment of non-personal data be reconsidered, that the restrictions on cross-border transfer be softened, that localisation obligations be dropped, and that further consultation be held before the Bill was taken up. Civil society organisations wrote in the opposite direction, on the exemptions and on the regulator. The government gave no indication in Parliament of which way it would move, and the withdrawal, when it came in August, was the first public evidence that the answer was neither adoption nor amendment but replacement. The Bill was not withdrawn in haste after an unexpected report. Seven months elapsed, representations were received from every side, and the decision taken at the end of them was to discard the text altogether.

On 18 November 2022 the Ministry published the draft Digital Personal Data Protection Bill, 2022 for public consultation, with comments invited into January 2023. It was a fraction of the length of the text it replaced, and its design philosophy was announced in its structure. The tiers of personal data were gone: there was one category of personal data, and the statute was confined to digital personal data. Localisation was gone: transfers abroad were to be permitted to countries the Central Government notified, a restricted-list approach in place of the permission-based approach of the earlier drafts. Data portability and the right to restrict continuing disclosure were gone. The compensation claim was gone, and in its place stood penalties of up to five hundred crore rupees for the gravest breaches, payable to the State. The regulator was renamed a Board, the Data Protection Board of India, to be established by the Central Government, and the draft dealt with its appointment and functioning at a level of generality the earlier drafts had not attempted. A concept the committee drafts had not used, deemed consent, appeared as a ground of processing. The journalistic exemption did not reappear.

Justice Srikrishna’s assessment of that draft, given in interview, was that it was simple in regard to simple things but did not rise to the level required for complex ones, that it gave too much margin to the government, and that it did little to guard the fundamental right to privacy of individuals. The Minister of State for Electronics and Information Technology, Rajeev Chandrasekhar, stated the government’s position in the same period: that the government would obtain access to personal data only in exceptional circumstances such as national security, a pandemic or a natural disaster, and that the proposed Board would be independent, with no government officer on it. Between those two statements lies the argument about the enacted Act, and it is taken up in full after the passage record and the comparison of the drafts are set out.

The Act of 2023: passage in days

The Bill that became the Act was introduced in the Lok Sabha on 3 August 2023, a year to the day after the withdrawal of its predecessor. Its passage stands in the sharpest possible contrast with the six years of drafting that preceded it. The Lok Sabha passed it on 7 August 2023, by voice vote, in a sitting from which a large part of the opposition was absent in the course of an unrelated confrontation with the government. The Rajya Sabha passed it on 9 August. The President, Droupadi Murmu, assented on 11 August 2023, eight days after introduction, and the Digital Personal Data Protection Act, 2023 entered the statute book as Act 22 of 2023. There was no reference to a committee of either House. The demands for such a reference, made in both Houses, were not accepted.

The contrast is not a rhetorical flourish; it is the analytical point about this statute’s legislative history. The version of the project that contained the most protection for the individual spent two years in committee and was withdrawn. The version that contained the least was passed in eight days without committee scrutiny, in the monsoon session, amid noise about other business. Whatever view a reader takes of the merits, the procedural record is itself evidence about how the Indian legislative system allocates scrutiny: the scrutiny was lavished on the drafts that failed, and the text that succeeded was the one that was not examined. The provisions of the enacted statute, section by section, are the subject of the pillar article on the Act, and this article confines itself to what the Act’s place in the sequence shows.

The passage also completed a small drafting change that illustrates the government’s method. The consultation draft of 2022 had gathered its non-consent grounds under the expression deemed consent, which drew the objection that consent which is deemed is not consent at all, and that the label concealed the breadth of the grounds it covered. The Bill as introduced dropped the expression and enacted the same structure under the heading of certain legitimate uses, covering among others the purposes for which an individual has voluntarily provided data, the performance of State functions and the provision of benefits and services by the State, compliance with judgments and orders, medical emergencies, and employment purposes. The substance of the objection was not met; the label that provoked it was removed. It is a minor episode, and it is recorded here because it is characteristic of the final stage of the project, in which the drafting energy that earlier versions had spent on the design of safeguards was spent instead on the presentation of a settled design.

The debate itself was brief. The Internet Freedom Foundation, which tracked the passage, recorded approximately two hours of discussion across both Houses for a statute that had been in preparation for six years, in a session in which a substantial number of opposition members were absent or suspended in connection with unrelated proceedings. Members who did speak raised the State exemptions, the composition of the Board and the amendment of the transparency statute, and pressed for reference to a select committee. The government declined, and the Bill passed on voice votes in both Houses.

What the sequence shows can be summarised in the Act’s own dimensions. It is a short statute of forty-four sections, governing digital personal data only. It recognises a single category of personal data. It gives the data principal rights of access to information about processing, of correction and erasure, and of grievance redressal, and it imposes on the data principal a set of duties, including a duty not to register a false or frivolous grievance, backed by a penalty. It restricts transfers abroad only to countries the Central Government chooses to notify as restricted. It empowers the Central Government to exempt instrumentalities of the State by notification. It establishes a Data Protection Board whose chairperson and members the Central Government appoints for terms of two years. And in its final substantive section it amends three other statutes, one of which is the transparency statute, in terms examined in detail below.

Four drafts, one column each

The table that follows is the comparison on which the argument of this article rests. It sets the four texts side by side, the draft Bill submitted with the Srikrishna Committee’s report in 2018, the Bill introduced in Parliament in 2019, the text recommended by the joint committee in 2021, and the Act of 2023, and it records the position of each text on the nine elements that were contested throughout the decade. Reading across any row shows a drafting decision being taken, usually more than once, and almost always in the same direction.

Contested element	Draft Bill of 2018	Bill of 2019	Joint committee text of 2021	Act of 2023
Sensitive data categories	Sensitive and critical tiers defined, with heightened duties and explicit consent for sensitive data	Both tiers retained; critical data left to be notified by the Central Government	Tiers retained	Tiers abolished; a single category of personal data
Localisation	Serving copy of all personal data to be stored in India; critical data processed only in India	Sensitive data to continue to be stored in India though transferable on conditions; critical data processed only in India	Mirror copies of sensitive and critical data held abroad to be brought to India	No localisation requirement
Data portability	Conferred as a right of the data principal	Conferred	Retained	Absent
Journalistic exemption	Present, tied to codes of journalistic ethics	Present, tied to Press Council and media self-regulatory codes	Retained	Absent; journalism within the Act
State exemption	Security of the State only, and only under a law that is necessary and proportionate	Any government agency exemptible by written order on wide grounds, including public order	Exemption retained, with a just, fair, reasonable and proportionate procedure recommended	State instrumentalities exemptible by notification in the interests of sovereignty, integrity or security of the State
Regulator independence	Authority; selection committee chaired by a nominee of the Chief Justice of India	Authority; selection committee of officials chaired by the Cabinet Secretary	Authority retained	Board appointed by the Central Government, with two-year terms
Compensation	A harmed data principal could claim compensation	Claimable through adjudicating officers under the Authority	Retained	Absent; penalties are payable to the Consolidated Fund of India
Transfer approach	Transfers permitted on stated conditions and approved routes	Transfers of sensitive data permitted on stated conditions	Conditions retained	Transfers permitted except to countries restricted by notification
Transparency amendment	Committee proposed an amendment stating when disclosure of personal information is proportionate	No amendment to the transparency statute	No amendment proposed	Exemption rewritten as information which relates to personal information

The table has four columns rather than five, and the missing text is the consultation draft of November 2022. It is omitted because on every element in the table its position is the position the Act took, which is the single most economical statement of the relationship between the last two texts: the draft of 2022 was not a stage in a negotiation among designs but the point at which the design was settled, and the Bill introduced the following August altered its presentation more than its substance. A reader who wants the moment at which the decade’s argument was decided should look there, to a consultation paper published eleven months after a parliamentary committee reported, rather than to the week of passage in 2023 when the decision was registered.

Three things about the table deserve emphasis before the element-by-element account that follows. The first is that no row moves in both directions. On every contested element the sequence is either stable or a single-direction movement away from obligation and towards discretion, and there is no element on which the Act is more demanding than the draft of 2018. The second is that the joint committee column is the row-reader’s surprise: on localisation and on the procedure for State exemption, the committee of Parliament was more protective than the government that had introduced the Bill, which is the opposite of the assumption usually made about committee stages in this field. The third is that the committee column changed nothing, because its text was never voted on. A comparison of drafts in this subject is necessarily a comparison of intentions at different moments, and only the final column has legal effect. That is precisely why the comparison matters: it identifies which intentions were abandoned, and when, and by whom.

What was dropped, element by element

The sensitive and critical tiers were the drafts’ way of grading obligation by risk. A password, a health record and a record of caste or religious belief are not the same kind of fact as a name on a mailing list, and the Srikrishna draft said so in the text: sensitive personal data required explicit consent, was subject to tighter transfer conditions, and grounded the localisation rules. The 2019 Bill kept the tiers while leaving critical data to be defined by government notification, a delegation that meant the hardest category in the scheme had no content until the executive supplied it. The Act abandoned the classification altogether. Under the enacted statute, all digital personal data stands on the same footing, and the additional safeguards the Rules provide are directed at classes of fiduciary, notably the significant data fiduciaries the government notifies, rather than at classes of data. The change is defensible as simplification, and the government defended it on exactly that ground. Its consequence should still be stated accurately: the heightened consent and storage duties that two drafts attached to the most intimate categories of information do not exist in the enacted law, and a health record and a marketing contact are governed by the same provisions.

Localisation was the element on which the drafts were most demanding and the Act most permissive, and it is the element whose disappearance is most often misdescribed, because arguments for it continue to be made as though it survived. The 2018 draft required a serving copy of all personal data to be kept in India, allowed sensitive data to be transferred only on conditions while continuing to be stored in India, and confined the processing of critical data to India altogether. The 2019 Bill dropped the general copy requirement and kept the sensitive and critical rules. The joint committee would have tightened them. The Act contains none of it. A data fiduciary may store and process personal data wherever it chooses, subject to the transfer rule and to sectoral requirements imposed by other regulators under other statutes, which are separate instruments and should not be confused with a localisation provision in the data protection statute. The reasons given for dropping it were cost, the doubtful security benefit of compelling storage geography, and the friction it created with India’s trading partners and with the cross-border structure of the services Indians use. Those reasons were argued at length during the committee stage by industry witnesses, and the committee was not persuaded. The government was, later, and the provision went.

Localisation did not, however, leave Indian law when it left the data protection statute, and a reader of the table should not conclude that the policy was abandoned across the board. In April 2018, three months before the Srikrishna Committee reported, the Reserve Bank of India had directed payment system providers to ensure that the data relating to the payment systems they operated was stored only in India, and that direction was enforced against international card networks and payment companies with considerable publicity. Sectoral localisation of that kind survived the decade untouched, because it rests on the regulator’s own statutory powers rather than on the data protection statute. The outcome of the sequence is therefore more specific than a national change of mind about where data should sit. It is that the general statute abandoned localisation while the sectoral regulators kept theirs, so that the strictest storage obligations in Indian law apply to payments data under a central bank direction and not to health records, children’s data or the records of the State under the statute enacted to govern personal data generally.

Data portability and the right to restrict continuing disclosure were the two rights in the drafts that reached beyond access and correction, because both of them transferred power rather than information. Portability obliged a fiduciary to hand back the data a principal had provided, in a structured and machine-readable form, so that the principal could take it to a competitor; its purpose was as much about competition and lock-in as about privacy. The right to restrict continuing disclosure, granted through an adjudicating officer where data had served its purpose or consent had been withdrawn, was the Indian form of the right to be forgotten, and it was the right most likely to be invoked against search results, archives and news reports. Neither appears in the Act. The omission of the second of them has a context a legislative history should supply. During the years in which the drafts were being written and rewritten, High Courts had begun, in individual cases before them, to direct the removal of personal material from public access on privacy grounds, most often the names of parties in concluded proceedings and material whose continued circulation served no public purpose. The right to be forgotten was therefore not an import the drafts were proposing to invent; it was a judicial practice in search of a statutory form, and the drafts supplied one, with an adjudicating officer, stated conditions and an appeal. The Act’s silence leaves the practice where it was, in the discretion of courts acting case by case, with no statutory criteria and no route for the person who holds the material to know in advance what the law requires. The enacted rights are access to a summary of processing, correction, completion and updating, erasure where the purpose is spent or consent withdrawn, grievance redressal, and nomination. Those are real rights, but they are rights against the fiduciary who holds the data, exercisable within the relationship. The two rights that would have let an individual move data between services, or suppress its continued circulation beyond the original relationship, are the two that were left out, and the pattern of the selection is worth noticing.

The scope of the subject itself narrowed as well, in a way the table does not capture. The drafts of 2018 and 2019 governed personal data as such, in whatever form it was held, and reached manual processing by larger fiduciaries. The Act governs digital personal data: data collected in digital form, or collected otherwise and digitised. Personal information held on paper and never digitised is outside it. For a country in which a large share of consequential records, in land offices, hospitals, police stations and schools, begins on paper, that is a significant boundary, and it was drawn in the draft of 2022 and kept in the Act without the attention given to the other omissions.

The exemption that journalists lost

The journalistic exemption is the omission with the most specific constituency, and it is the one whose absence has generated a continuing dispute rather than a settled acceptance. Both the 2018 draft and the 2019 Bill contained it. In the Bill as introduced it appeared in the exemption clause for specified purposes: processing of personal data necessary for or relevant to a journalistic purpose was exempted from a defined set of obligations, on condition that the processing complied with a code of ethics issued by the Press Council of India or by a media self-regulatory organisation. The Srikrishna Committee’s reasoning for it was practical. Journalism consists substantially of processing personal information about people who have not consented to the processing and would refuse if asked, beginning with the subjects of investigation. A statute that required consent as the ordinary ground of processing, without a journalistic carve-out, would make the consent of the person reported on a precondition of reporting on them, and the committee regarded that as unworkable for a free press.

The exemption did not appear in the draft of 2022 and does not appear in the Act. The consequence is structural rather than rhetorical. A news organisation processing personal data is a data fiduciary like any other, and an individual journalist doing so is within the statute’s reach. The grounds on which processing is permitted without consent, the certain legitimate uses set out in the Act, do not include journalistic purpose. Consent is therefore the operative ground for a large part of ordinary reporting, and the data principal’s rights of access, correction and erasure are, on the face of the text, available against a newsroom in respect of material gathered for publication. Reporters who work with leaked documents, source notes and contact books hold personal data in the course of their work as a matter of routine, and the absence of a carve-out is why guidance on how journalists use VaultBook to protect sources has become practical reading in newsrooms rather than a curiosity: the statute gives the source relationship no protection of its own, so the protection has to be supplied by the journalist’s own systems.

The dispute after enactment is part of the legislative history and should be recorded. In February 2024 the Editors Guild of India submitted a representation to the Ministry of Electronics and Information Technology recording grave concerns about the Act’s effect on journalistic activity, pointing to the consent requirement and seeking a class exemption for fiduciaries processing data for journalistic purposes, of the kind the Act empowers the government to grant for specified classes for a limited period. Media organisations repeated the request during the consultation on the draft Rules published in January 2025. In July 2025 the Secretary of the Ministry met press bodies and, as the Guild recorded, assured them that journalistic work would not fall within the purview of the Act. The Guild and other media organisations asked for that assurance to be made legally tenable, by clarification or amendment, and submitted a detailed set of questions and case-based scenarios. The Rules as notified in November 2025 did not address the journalistic exemption. The Guild’s statement on the notification said that the rules continued to leave the questions unresolved and that ambiguous obligations around consent risked exposing journalists and newsrooms to compliance burdens that would impede routine reportage.

The Guild was not alone. The DIGIPUB News India Foundation, which represents digital-only news publishers, issued a statement on the notification arguing that the Rules endangered journalism and weakened the transparency regime, and that the framework granted the government wide access and enforcement powers while providing no statutory exemption for journalists. The two bodies between them cover the established press and the digital-native press, and their agreement on the point is itself part of the record: the objection to the omission is not a legacy-media objection. It is also worth recording what the press bodies asked for, because it was modest in form. They did not ask for the Act to be reopened. They asked for the class exemption the Act itself authorises the government to grant, or for a clarification with legal force, and the answer they received was an oral assurance in a meeting, recorded by the Guild, that journalistic work would not fall within the Act’s purview. An assurance of that kind binds nobody and cannot be pleaded before the Board, which is why the Guild continued to press for a tenable instrument after receiving it.

The counter-argument exists and deserves statement in its own terms, as the brief for this article requires. A general exemption for journalistic purposes is difficult to confine. In an environment in which publication is open to anyone with a phone, an exemption keyed to purpose rather than to an accredited status invites every data broker, aggregator and influence operation to describe its processing as journalism, and a regulator asked to police the boundary would have to decide who counts as a journalist, a decision the State is not obviously the right institution to take. The Press Council and self-regulatory codes to which the 2019 clause tied the exemption cover print and broadcast unevenly and digital-only publication hardly at all, so the condition the drafts attached would itself have required construction. Both positions are coherent. What the record establishes is narrower than either: two drafts contained the exemption, the enacted Act does not, the affected profession asked for it to be restored by the exemption power the Act itself contains, and the Rules did not restore it.

Compensation, the regulator and the transfer reversal

Three further omissions share a common feature: each removed a mechanism by which power was to be checked by someone other than the government.

Compensation was the individual’s mechanism. Under the 2018 draft and the 2019 Bill, a data principal who suffered harm from a contravention could recover compensation from the fiduciary or processor responsible, adjudicated through the Authority’s adjudicating officers. India’s pre-existing law had pointed the same way: the compensation provision of the technology statute, section 43A, was the foundation of the whole 2011 regime. The Act of 2023 contains penalties of real size, up to two hundred and fifty crore rupees for a failure to take reasonable security safeguards to prevent a personal data breach, and graded amounts for other contraventions, but every rupee of them is a penalty payable to the Consolidated Fund of India. The person whose data was breached, and who may have suffered loss, identity theft or distress in consequence, has no claim under the Act to any part of it, and no free-standing compensation route under the Act at all. The distinction between a penalty and compensation is elementary and the substitution is easy to miss in summaries of the statute, which is why it is worth stating in a legislative history: the drafts made the harmed individual a claimant; the Act makes the harmed individual a complainant whose complaint may enrich the exchequer.

The regulator was the institutional mechanism. The 2018 draft’s Authority was to be appointed on the recommendation of a committee chaired by a nominee of the Chief Justice of India, with security of tenure and protected conditions, and with power to issue codes of practice and directions of general application. The 2019 Bill removed the judicial element from selection and vested recommendation in a committee of secretaries chaired by the Cabinet Secretary, while keeping an Authority of a chairperson and six members. The Act establishes a Data Protection Board of India. Its chairperson and members are appointed by the Central Government. Their term is two years, with eligibility for re-appointment, a tenure markedly shorter than those of the heads of comparable Indian regulators and one that places a member seeking a second term in a relationship of dependence on the appointing government during the first. The Board’s functioning is designed to be digital in its office and its proceedings, and its orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal. It has no general code-making power of the kind the drafts gave the Authority; the rule-making power under the Act lies with the Central Government. The Board is therefore better understood as an adjudicatory body appointed by the executive than as an independent regulator of the kind the two drafts proposed, and that difference in character, rather than any question about the individuals appointed, is the drafting choice to record.

The transfer rule was the external mechanism, and here the change is a reversal of logic rather than a removal. The drafts worked on a permitted-list basis: transfers abroad were lawful on stated conditions, through approved routes, and for sensitive data only with additional safeguards, so that the default question was whether a transfer was authorised. The Act works on a restricted-list basis: a data fiduciary may transfer personal data to any country or territory, except one the Central Government notifies as restricted. The default question is whether a destination has been prohibited. Both are workable designs, and the second is simpler to administer, but they distribute the burden of justification in opposite directions, and the reversal was effected without the localisation debate ever being formally concluded: the permitted-list structure disappeared together with the localisation rules it supported.

What was added: a wider State exemption and duties for the data principal

A history that recorded only omissions would misdescribe the Act, because two of its features were not survivals from the drafts but additions to them, and both run in the same direction as the omissions.

The exemption power for the State widened at every stage of the sequence, and it is the single provision whose trajectory is unambiguous. The 2018 draft permitted processing for the security of the State only where authorised by a law made by Parliament, conducted under the procedure that law laid down, and necessary and proportionate to the aim. The 2019 Bill replaced that with executive satisfaction, exercised by written order on grounds that included public order and friendly relations with foreign States, over any agency of the Government. The joint committee recommended adding a procedural discipline to the power. The Act empowers the Central Government, in the interests of the sovereignty and integrity of India or the security of the State, to notify instrumentalities of the State to which the Act, or specified provisions of it, will not apply. Alongside that power, the Act’s exemptions section also disapplies most obligations for processing necessary to enforce a legal right or claim, for processing by courts and tribunals, for processing of the data of principals outside India under foreign contracts, and, subject to standards, for research, archiving and statistical purposes. The ground that mattered constitutionally, however, is the notifying power over State instrumentalities, because the State is the largest single processor of personal data in the country and the entity against which the fundamental right recognised in 2017 is principally held. The exemption of that entity by its own notification is the provision on which the proportionality test of the privacy judgment will eventually be brought to bear, and the drafts’ history shows that narrower formulations were available, were drafted, and were set aside.

Alongside the notifying power, the Act treats the ordinary administrative processing of the State as a ground of lawful processing in its own right. Among the certain legitimate uses for which consent is not required are the purposes for which an individual has voluntarily provided data, and the performance by the State of its functions and the provision by it of subsidies, benefits, services, certificates, licences and permits. The practical consequence is that the processing by which most citizens encounter the State, the processing attached to welfare delivery, identity documents and public services, proceeds without consent as a matter of design, and the protections that apply to it are the fiduciary obligations of security, accuracy and breach notification rather than the consent architecture the statute builds for private processing. The drafts had reached a similar destination for State functions by a different route, through enumerated non-consent grounds hedged with conditions; the Act’s route is broader and sits in the operative chapter rather than in the exemptions, which is where a reader should look for the State’s true position under the statute.

The duties of data principals are an addition of a different kind, and they have no counterpart in the committee drafts. The Act provides that a data principal shall not impersonate another person while providing personal data for a specified purpose, shall not suppress material information while providing data for a document issued by the State, shall not register a false or frivolous grievance or complaint with a fiduciary or the Board, and shall furnish only information that is verifiably authentic where it is furnished under a right the Act confers. The Schedule to the Act attaches a penalty of up to ten thousand rupees to breach of these duties. Indian data protection drafts before 2022 had conceived the individual exclusively as the holder of rights against processors. The enacted statute also conceives the individual as a bearer of duties towards them, enforceable in money. Whether that is a legitimate legislative choice about the abuse of grievance machinery or a burden placed on complainants is contested; that it is an addition, introduced in the shortest of the drafts and retained in the Act, is a matter of record.

The transparency amendment

One consequence of the Act lies outside data protection altogether, and it is the consequence this article owns in the series, because the transparency cluster approaches it from the other side. Section 44 of the Act amends other statutes. Among those amendments, the one in sub-section (3) rewrites clause (j) of section 8(1) of the Right to Information Act, 2005, the exemption for personal information. The amendment is short enough that precision costs nothing, and precision is what the public argument about it has lacked.

Clause (j) as enacted in 2005 exempted information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual, unless the Central or State Public Information Officer or the appellate authority was satisfied that the larger public interest justified disclosure. It carried a proviso: the information which cannot be denied to Parliament or a State Legislature shall not be denied to any person. The clause therefore did three things. It exempted personal information only where one of two qualifying conditions held, absence of a relationship to public activity or interest, or unwarranted invasion of privacy. It subjected the exemption to an internal override where the larger public interest justified disclosure. And by the proviso it tied the citizen’s entitlement to the legislature’s, so that material which had to be given to a legislature could not be withheld from a requester.

Section 44(3) of the data protection Act substitutes the whole clause with a single phrase. Clause (j) as substituted exempts information which relates to personal information. The qualifying conditions do not appear in the substituted clause. The larger public interest override does not appear in it. The proviso about Parliament and the State Legislatures does not appear in it. The substituted text is a categorical exemption for information relating to personal information, of the same grammatical form as the other clauses of section 8(1), which exempt categories such as information received in confidence from a foreign government or information whose disclosure would endanger life or physical safety. Readers comparing the two texts should work from the guide to the Right to Information Act for the structure of the transparency statute and the analysis of the 2019 amendment to that Act for the earlier occasion on which the statute’s balance was legislatively adjusted.

The effect should be described, as this article’s brief directs, rather than characterised. Before the substitution, a public information officer asked for personal information had to work through the clause’s own tests, and a large body of decisions of the information commissions and the courts, including the Supreme Court’s reading of the clause in Girish Ramchandra Deshpande v Central Information Commissioner, was built on the presence of those tests. After the substitution, the clause contains no test to work through: if the information relates to personal information, it is within the exemption. The general provision in section 8(2) of the transparency Act, under which a public authority may allow access to exempt information where the public interest in disclosure outweighs the harm to the protected interests, survives untouched, and the government’s defence of the amendment, given by the Minister in Parliament, rests on it: that the amendment harmonises the transparency statute with the fundamental right to privacy, and that section 8(2) continues to supply the public interest route.

The difference between the two instruments is one of legal posture, and it can be stated without rhetoric. Section 8(2) is permissive: it says a public authority may allow access notwithstanding the exemptions, where the officer judges that the public interest in disclosure outweighs the harm. The deleted words in clause (j) were mandatory in structure: they defined the boundary of the exemption itself, so that information falling outside the boundary was not exempt at all, and a refusal had to be justified by bringing the information within it. Under the original clause the officer’s first question was whether the exemption was available; under the substituted clause it is available whenever the information relates to personal information, and the officer’s discretion under section 8(2) is the only route back. Appellate practice under the transparency Act had built the first of those questions into a discipline, because information commissions could and did hold that material relating to a public activity, such as the service record and conduct of a public servant, fell outside clause (j) without any need to reach a balancing exercise. The Deshpande decision itself illustrates the discipline at work: the Supreme Court’s reasoning proceeded by applying the clause’s own tests, of relationship to public activity and of unwarranted invasion, to the service details and asset particulars of a public servant that had been sought, and by treating matters such as caste and religion as personal in a stricter sense still. That sorting exercise, which the text required and the commissions performed daily, has no textual foothold in the substituted clause. The critics’ response, made by transparency advocates and former information commissioners among others, is that a discretionary power to disclose notwithstanding an exemption is a different instrument from a test written into the exemption itself, with the burden it placed on the officer to justify refusal, and that the removal of the proviso severs the link between the citizen’s right and the legislature’s. Both descriptions of the text are accurate. They differ about what the difference amounts to.

Two further points complete the record. The first is timing. The substitution was brought into force in November 2025, on the notification of the Rules, with immediate effect, while the principal obligations the Act imposes on private processors were staged to begin later. The amendment that restricts an existing right of access therefore took effect at the front of the commencement sequence, ahead of the duties it was enacted to accompany. The second is the contrast with the design of 2018. The Srikrishna Committee had considered the same clause and proposed the opposite technique: an amendment that would state the circumstances in which disclosure of personal information is a proportionate restriction of privacy, keeping a balancing test in the clause and specifying it. The enacted amendment removed the test. Of all the drafting choices in the sequence, this is the one that reaches furthest beyond the subject of the statute that made it, because it alters the operating terms of a different Act, in a different field, for every public authority in the country.

The two cases, stated fairly

A legislative history that ended with the table would leave the reader with the shape of the change but not the reasons anyone defended it, and the stance of this series requires each side to be put at the strength its proponents put it.

Why is the Act of 2023 so much shorter than the drafts that preceded it?

Because brevity was the design. The government treated the detail of the earlier drafts as the cause of their compliance cost and their failure to pass, and chose a short principles-based statute that leaves operational detail to rules made under it. The drafts of 2018 and 2019 ran to over a hundred clauses; the Act has forty-four sections.

The government’s case begins with the fate of the drafts themselves. The maximalist design was not enacted, twice. A committee of experts produced a statute of European density in 2018; the government’s own Bill of 2019, examined for two years, attracted eighty-one proposed amendments and a demand to extend it to non-personal data; the project had consumed five years by the time of the withdrawal without producing a law, in a field in which the technology and the market changed materially inside that period. A design that cannot be enacted protects nobody, and the government’s stated objective from November 2022 onwards was a statute that was simple in language, confined to digital personal data, and capable of being complied with by the small and medium enterprises that constitute most Indian data processing, with detail supplied by rules that can be amended as practice develops. The Minister of State’s defence of the exemptions followed the same line: access by the government to personal data in exceptional circumstances, national security, a pandemic, a natural disaster, and a Board that would be independent in its working. On localisation, the government’s position across the committee stage and after it was that compulsory storage geography imposed heavy costs on Indian firms and start-ups, raised the price of cloud services in India, delivered no demonstrated security benefit, since data is protected by encryption and access control rather than by the location of the server, and exposed Indian data to reciprocal demands from other jurisdictions. On compensation, the penalty model was defended as the modern regulatory pattern: deterrence through penalties set at levels a board cannot ignore, rather than individual claims that in practice are brought by few and settle for little. The Act equips the Board, in fixing a penalty, to weigh the nature, gravity and duration of the breach, the type and nature of the personal data affected, whether the breach is repetitive, whether the fiduciary gained or avoided loss by it, the mitigating action taken, and the likely effect of the penalty on the fiduciary, which is a recognisable proportionality apparatus of the kind a sentencing court applies. On this account, the individual’s interest is protected indirectly but rationally: the prospect of a substantial penalty, calibrated under those factors, disciplines the fiduciary before the event in a way a compensation claim brought after it does not. On this account the omissions in the table are not dilutions but corrections of a design that had been written for a regulatory state India does not possess and at a cost its firms could not carry.

The critics’ case begins with the judgment of 2017 and asks what the statute was for. Privacy was recognised as a fundamental right because State power over information about citizens had grown without a legal framework to discipline it; the litigation that produced the judgment was a challenge to a State identity programme, not to a marketing database. A statute answering that judgment should therefore be at its most demanding where the State is the processor. The enacted statute is at its least demanding there: State instrumentalities may be exempted by the government’s own notification, the exemptions for State functions among the certain legitimate uses are broad, and the body that polices the boundary is appointed by the government for two-year terms. Justice Srikrishna, the chairman of the committee that produced the first draft, made the argument in its sharpest form across the sequence: of the 2019 Bill, that the removal of the safeguards in the State exemption was dangerous and could turn India into an Orwellian State; of the 2022 draft, that it was simple about simple things and inadequate to complex ones, gave too much margin to the government, and would not safeguard citizens against the misuse of their data by government agencies. Apar Gupta of the Internet Freedom Foundation made the institutional version of the point at the withdrawal, observing that a decade had passed since the A. P. Shah report, five years since the privacy judgment and four since the Srikrishna report, and that each day of delay caused continuing injury. The Editors Guild of India made the professional version of it in respect of journalism. On compensation, the critics’ point is not that penalties are too small but that they are paid to the wrong party, so that a person harmed by a breach has no route under the statute to be made whole. On this account the Act regulates private processing with some care while leaving the processing that prompted the constitutional litigation substantially to executive discretion, which inverts the concern that produced the judgment.

The verdict this article defends is a narrow one, because the record supports a narrow one. Both accounts describe the same texts accurately; they disagree about the purpose of the statute, and that disagreement cannot be settled by comparing drafts. What the comparison does settle is the factual premise each side relies on. The government’s premise, that the earlier design was too costly and too complex to enact, is supported by the project’s own history of failure, though the history also shows that the failure was a choice among available routes rather than a necessity. The critics’ premise, that the Act constrains private processing more firmly than State processing, is not an interpretation but a description of where the obligations and the exemptions sit in the text, and it is confirmed by the table above. A reader is entitled to conclude either that a lean statute that exists is worth more than a demanding one that does not, or that a statute which exempts its own author from its discipline fails the purpose for which the right was recognised. The reader is not entitled to deny the asymmetry, because it is in the drafting, and the drafting is a matter of record. The general account in this article is legal information and analysis; it is not advice on any individual compliance question or dispute, and positions that turn on notified commencement dates should be checked against the notifications before they are relied on.

Rules in 2025 and a commencement that runs to 2027

An Act whose provisions commence on notified dates is not finished when it is assented to, and this Act’s post-enactment history is the third of the failure modes with which this article began. Draft Digital Personal Data Protection Rules were published for public consultation on 3 January 2025, seventeen months after assent. The final Rules were notified in November 2025, and the commencement notifications that accompanied them distributed the Act’s provisions across three points in time. A first block took effect on notification, including the establishment of the Data Protection Board and the amendment of the transparency statute examined above. A second block, including the registration regime for consent managers, follows twelve months after notification. The principal block, containing the operative obligations on data fiduciaries, notice and consent in their detailed form, security safeguards, breach notification to the Board and to affected principals, the duties concerning children, and the additional obligations of significant data fiduciaries, applies eighteen months after notification, in May 2027.

The Rules themselves are the first exercise of the design choice the Act embodies, and their contents show what the choice means in practice. They prescribe the form and content of the notice a fiduciary must give, the manner in which consent is to be sought and withdrawn, the registration and obligations of consent managers, the intimation of a personal data breach and the fuller report that must follow it, the erasure of data when the purpose is spent, including prescribed retention periods after which the largest platforms, in electronic commerce, online gaming and social media, must delete the data of inactive users, and the procedure of the Board as a digital office. The Ministry presented them as drafted on a principle it named SARAL, for simple, accessible, rational and actionable law. Every one of those subjects was a subject on which the drafts of 2018 and 2019 had legislated in the statute itself, in clauses that committees and courts could construe. In the enacted design they are matters of delegated legislation, amendable by notification without a parliamentary vote, which is the institutional form of the same preference for executive flexibility that the exemptions express. A legislative history is the right place to note the continuity, because it is easy to miss when the Act and the Rules are read separately: the statute is short not because its subjects are few but because so many of them were moved out of it.

The staging has a consequence that a legislative history should record without ornament. Between August 2017, when the Supreme Court held that privacy is a fundamental right and treated a data protection framework as the appropriate statutory response, and May 2027, when the central obligations of the statute enacted in response begin to bind the entities it governs, ten years will have elapsed. In that interval the operative law of India on the processing of personal information by companies remained the Rules of 2011 and section 43A of the technology statute, supplemented by sectoral directions. The delay is not attributable to any single actor: it is the sum of a committee year, a ministerial redrafting of sixteen months, a committee stage of two years, a withdrawal, a fresh draft, and a commencement staged over thirty months after assent. But the sum is the fact, and it is the fact that makes this subject the most complete available case study of the distance between the recognition of a right in India and the imposition of the obligation that gives the right practical content.

The verdict on the decade

The data protection project is usually told as a story of delay, and the delay is real, but the delay is not the most instructive part of it. The instructive part is that the process worked in the ordinary way at every stage and produced this outcome. An expert committee was appointed and reported with a draft. A ministry redrafted the draft in the direction of its own institutional interests, as ministries do. A parliamentary committee examined the redraft for two years and improved parts of it while expanding its scope past the point the government would accept. The government withdrew the Bill rather than defend or amend a text it no longer wanted, and replaced it with a text that asked less of everyone, including itself. That text passed in eight days with little scrutiny, because by then the argument had been running for six years and the appetite for it was spent. Rules took a further two years, and commencement was staged beyond them.

Nothing in that sequence required bad faith at any point, and nothing in it was unusual. Each step is a familiar feature of Indian lawmaking, documented across this series in subjects as different as land acquisition, labour codes and criminal law reform.

The passage record also supports a prediction about how the enacted Act will operate, and a legislative history is the place to make it, since it is a prediction from the drafting choices rather than from the text alone. The provisions most likely to be tested first are the ones that took effect first, and the amendment of the transparency statute is already in force and already being applied by public information officers, which makes it the likeliest source of the Act’s first appellate jurisprudence, in a field the Act was not principally about. The exemption of State instrumentalities will be tested when a notification under it is challenged, and the challenge will be argued, on the material set out in this article, as a proportionality case about a choice the drafters made with narrower alternatives in front of them. The Board’s practical authority will be settled less by its formal powers than by its first penalties against large fiduciaries and its first refusal to proceed against a State instrumentality. And the compensation gap will be filled, if it is filled, from outside the Act, by claims under other statutes and in constitutional tort, because the Act itself closed the route the drafts had opened. None of that is certain. What is certain is that the arguments will be conducted by reference to the sequence of texts, because in this subject the sequence is where the choices are. What the data protection sequence offers, and what no other subject in the series offers in one place, is the sight of all of the steps operating on a single text whose every version survives for comparison. The drafts are the evidence. A reader who has worked through them can say, with the documents open, what India decided its data protection law would not do: it would not grade data by sensitivity, would not require data to be kept in India, would not let an individual carry data away from a service or suppress its continued disclosure, would not exempt journalism, would not pay the person harmed, and would not place enforcement in the hands of a regulator the government does not appoint. Each of those was, at some point in the decade, the settled content of the draft on the table. The history of the statute is the history of their removal, and that is the answer to the question with which the argument about the Act usually begins.

Frequently Asked Questions

Q: How long did India take to enact a data protection law?

The answer depends on where the count begins. From the notification of the Sensitive Personal Data or Information Rules in April 2011 to the assent of the Digital Personal Data Protection Act in August 2023 is twelve years. From the Supreme Court’s recognition of privacy as a fundamental right in August 2017 to that assent is six years, filled by an expert committee, a draft Bill, a Bill introduced and referred to a joint committee, a withdrawal and a fresh draft. From the recognition of the right to the date the Act’s principal obligations begin to bind those who process personal data, in May 2027, is ten years.

Q: What did the Srikrishna Committee recommend?

The committee of experts chaired by Justice B. N. Srikrishna, constituted by the Ministry of Electronics and Information Technology on 31 July 2017, reported on 27 July 2018 with a report titled A Free and Fair Digital Economy and a complete draft Bill. It recommended a fiduciary model in which the individual is the data principal and the processor a data fiduciary owing duties of trust. It proposed tiers of personal, sensitive and critical data with graded obligations, storage of a copy of personal data in India, rights of access, correction, portability and restriction of disclosure, compensation for a principal who suffered harm, processing for the security of the State only under a law that is necessary and proportionate, and an independent Data Protection Authority appointed through a selection committee chaired by a nominee of the Chief Justice of India.

Q: Why was the 2019 data protection bill withdrawn?

The government’s stated reason was the scale of the joint committee’s intervention. Moving the withdrawal in the Lok Sabha on 3 August 2022, the Minister of Electronics and Information Technology, Ashwini Vaishnaw, said the committee had proposed eighty-one amendments in a Bill of ninety-nine sections and twelve further recommendations towards a complete legal framework for the digital ecosystem, that such a framework was being worked upon, and that the Bill was therefore withdrawn so that a new Bill fitting the framework could be presented. The committee’s amendments included extending the Bill to non-personal data and renaming it. A replacement draft for public consultation followed in November 2022, shorter and differently designed, which indicates that the government also preferred a different kind of statute.

Q: What did the joint parliamentary committee say?

The joint committee of both Houses, which examined the Personal Data Protection Bill, 2019 for two years under chairpersons Meenakashi Lekhi and then P. P. Chaudhary, reported on 16 December 2021. It proposed eighty-one amendments and twelve recommendations and attached a redrafted Data Protection Bill, 2021. Its central recommendation was expansion: because personal and non-personal data cannot be cleanly separated in practice, the statute should regulate both under a single regulator, and the word personal should leave the title. It recommended that exemptions for government agencies be exercisable only through a just, fair, reasonable and proportionate procedure, and that mirror copies of sensitive and critical personal data held abroad be brought to India. Several members filed dissent notes, directed mainly at the State exemptions and the regulator’s independence.

Q: What was dropped between the successive data protection drafts?

Comparing the draft of 2018 and the Bill of 2019 with the Act of 2023, the items present in the earlier texts and absent from the Act are these. The classification of personal data into sensitive and critical tiers, with heightened consent and storage duties, was abolished. Data localisation, the requirement that sensitive data continue to be stored in India and critical data be processed only in India, was removed entirely. The right to data portability and the right to restrict continuing disclosure of personal data were omitted. The express exemption for processing for journalistic purposes was not carried forward. The compensation claim by which a harmed data principal could recover from the fiduciary responsible was replaced by penalties payable to the State. And an independent Authority with a judicially led selection process was replaced by a Board appointed by the Central Government.

Q: What happened to the journalistic exemption in the data protection law?

It was present in the first two texts and absent from the last two. The draft of 2018 and the Personal Data Protection Bill, 2019 both exempted processing necessary for or relevant to a journalistic purpose from a defined set of obligations, provided the processing complied with a code of ethics issued by the Press Council of India or a media self-regulatory organisation. The consultation draft of November 2022 omitted it, and the Act of 2023 contains no journalistic exemption, so news organisations and journalists process personal data as data fiduciaries under the ordinary consent framework. The Editors Guild of India sought a class exemption in representations made in 2024 and during the consultation on the draft Rules in 2025. The Rules as notified in November 2025 did not address it.

Q: Which Right to Information exemption did the data protection law rewrite?

Section 44(3) of the Digital Personal Data Protection Act, 2023 rewrote clause (j) of section 8(1) of the Right to Information Act, 2005, the exemption for personal information. The original clause exempted personal information only where its disclosure had no relationship to any public activity or interest or would cause unwarranted invasion of privacy, and it allowed disclosure where the larger public interest justified it, with a proviso that information which cannot be denied to Parliament or a State Legislature shall not be denied to any person. The substituted clause exempts, in full, information which relates to personal information. The qualifying conditions, the public interest override within the clause and the proviso do not appear in the substituted text. The general public interest provision in section 8(2) of the transparency Act survives.

Q: What criticism did the final data protection Act attract?

The criticism has been consistent in direction from named quarters. Justice Srikrishna, who chaired the committee that wrote the first draft, argued across the sequence that the State exemptions were too wide and the safeguards removed, calling the corresponding provision of the 2019 Bill dangerous and saying of the 2022 draft that it gave too much margin to the government and did little to guard the fundamental right to privacy. The Internet Freedom Foundation, through Apar Gupta, criticised the delay and the breadth of the exemptions. The Editors Guild of India criticised the absence of a journalistic exemption and the dilution of the transparency regime. Transparency advocates criticised the rewriting of the personal information exemption in the Right to Information Act. The common thread is asymmetry: the Act binds private processing more firmly than State processing.

Q: What did the Sensitive Personal Data or Information Rules of 2011 require?

The Rules, notified on 11 April 2011 under section 43A of the Information Technology Act, 2000, were India’s operative data protection regime for over a decade. They defined sensitive personal data to include passwords, financial information, health condition and records, sexual orientation and biometric information. They required a body corporate collecting information to publish a privacy policy stating what was collected and why, to obtain written consent before collecting sensitive information, to collect only for a lawful purpose connected with its function, and to let the provider of information review and correct it. They required a named grievance officer, with contact details published, to redress grievances within a month. They treated documented security programmes, including the IS/ISO/IEC 27001 standard, as reasonable security practices, breach of which, with negligence and resulting wrongful loss or gain, grounded compensation under section 43A.

Q: What did the group of experts chaired by Justice A. P. Shah propose in 2012?

The Group of Experts on Privacy, constituted by the Planning Commission and chaired by Justice A. P. Shah, a former Chief Justice of the Delhi High Court, reported on 16 October 2012. It proposed nine national privacy principles for India: notice; choice and consent; collection limitation; purpose limitation; access and correction; disclosure of information; security; openness; and accountability. It recommended a privacy statute of general application covering government and private entities alike, enforced through privacy commissioners at the Centre and in the regions working with industry self-regulatory organisations in a co-regulatory structure. No Bill followed the report, but its principles supplied the vocabulary that the Srikrishna Committee adopted six years later and that the Rules of 2025 restate.

Q: How many drafts of a data protection Bill did India produce before the Act?

Four complete texts preceded the Bill that was enacted. The first was the draft Personal Data Protection Bill submitted by the Srikrishna Committee with its report on 27 July 2018, which was never introduced in Parliament. The second was the Personal Data Protection Bill, 2019, the government’s own redraft, introduced in the Lok Sabha on 11 December 2019. The third was the Data Protection Bill, 2021, the redrafted text attached to the joint committee’s report of 16 December 2021, which was never taken up for consideration. The fourth was the draft Digital Personal Data Protection Bill published for public consultation on 18 November 2022. The enacted Bill of August 2023 was a revision of that fourth text.

Q: What did the Personal Data Protection Bill of 2019 propose for social media platforms?

The Bill of 2019 dealt with large platforms through the category of the significant data fiduciary, a class the Data Protection Authority could notify by reference to factors including the volume and sensitivity of data processed and the risk of harm. Social media intermediaries with users above a threshold to be notified were brought within that class expressly. Significant data fiduciaries carried additional obligations, including data protection impact assessments, record keeping and periodic audits, and a data protection officer based in India. The Bill further provided that social media intermediaries classified as significant data fiduciaries should enable users to verify their accounts voluntarily and should provide a visible mark of verification for those who did. The voluntary verification proposal drew sustained objection as a step towards identity-linked speech, and it did not survive into the Act.

Q: What did the consultation draft of November 2022 change about the project?

The draft Digital Personal Data Protection Bill published for consultation on 18 November 2022 changed the project’s design rather than merely its detail. It confined the statute to digital personal data, where the earlier drafts covered personal data in any form. It abolished the sensitive and critical tiers, leaving a single category. It replaced the permission-based transfer regime and the localisation rules with a restricted list, under which transfers abroad would be allowed except to countries the Central Government notified. It dropped data portability, the right to restrict continuing disclosure, the compensation claim and the journalistic exemption. It renamed the regulator a Data Protection Board, introduced deemed consent as a ground of processing, and set penalties of up to five hundred crore rupees payable to the State. The Act of 2023 follows its design closely.

Q: What did the privacy judgment require of Parliament?

The nine-judge bench in Justice K. S. Puttaswamy (Retd.) v Union of India, which held on 24 August 2017 that privacy is a fundamental right, did not direct Parliament to enact a statute in terms, and a legislative history should not pretend otherwise. What the judgment did was change the legal setting in which legislation would be judged. The opinions treated invasions of privacy by the State as requiring a law, a legitimate aim and proportionality, and regarded a data protection statute as the appropriate framework for systematic processing of personal information by the State and by private parties. The government had constituted the Srikrishna Committee weeks before the judgment and pointed to it in argument. After August 2017 the committee’s draft was therefore read as the statute a fundamental right called for, and later dilutions of it were argued about in those terms.

Q: How far did the Indian drafts follow the European data protection model?

The draft of 2018 was the closest to the European General Data Protection Regulation, and the resemblance was deliberate. It shared the European architecture of defined data categories with graded protection, consent and specified alternative grounds, a rights chapter including portability and a form of the right to be forgotten, turnover-based penalties, an independent supervisory authority, and transfers abroad conditioned on approved safeguards. It also departed from the European model in two respects that were its own: the fiduciary framing of the relationship between individual and processor, and localisation requirements considerably stricter than anything in European law, which reflected an Indian policy argument about data as a national resource. Each successive text moved further from the European template. The Act of 2023 retains the vocabulary of consent, rights and a supervisory body but abandons the tiers, the portability right, the independent authority and the conditioned transfer regime that made the first draft recognisably European in structure.

Q: How did the treatment of State agencies change between the 2019 Bill and the 2023 Act?

The instrument changed and the grounds narrowed on paper, while the safeguards critics asked for were not added. Section 35 of the Bill of 2019 empowered the Central Government, where satisfied it was necessary or expedient on grounds including the sovereignty and integrity of India, the security of the State, friendly relations with foreign States and public order, to direct by order, for reasons recorded in writing, that all or any provisions should not apply to any government agency. The joint committee recommended adding a requirement that the procedure be just, fair, reasonable and proportionate. Section 17 of the Act instead empowers the Central Government to exempt instrumentalities of the State by notification, on the stated grounds of the sovereignty and integrity of India or the security of the State. Public order and friendly relations fell away as grounds; the recorded-reasons order and the proportionality procedure fell away as safeguards.

Q: What penalties does the 2023 Act impose instead of compensating the person harmed?

The Act’s Schedule sets monetary penalties for specified breaches, all payable to the Consolidated Fund of India and none of them payable to the individual whose data was involved. Breach of the obligation to take reasonable security safeguards to prevent a personal data breach carries a penalty that may extend to two hundred and fifty crore rupees. Failure to notify the Data Protection Board and affected data principals of a breach, and breach of the obligations concerning children’s data, each carry penalties that may extend to two hundred crore rupees. Breach of the additional obligations of a significant data fiduciary carries up to one hundred and fifty crore rupees, breach of the duties the Act places on data principals up to ten thousand rupees, and breach of any other provision a residuary penalty of up to fifty crore rupees.

Q: What happens to section 43A of the Information Technology Act under the 2023 Act?

Section 44 of the Digital Personal Data Protection Act amends the technology statute, and one of its amendments omits section 43A from the date appointed for that purpose. Section 43A was the compensation provision inserted in 2009 on which the entire regime of the 2011 Rules rested: it made a body corporate liable to pay compensation where negligence in maintaining reasonable security practices in handling sensitive personal data caused wrongful loss or wrongful gain. Its omission removes the statutory foundation of the 2011 Rules as the new framework takes effect, and it completes a change of philosophy. The older law compensated the person harmed through a claim; the Act penalises the fiduciary through the Board, with the proceeds going to the Consolidated Fund of India.

Q: When do the obligations created by the 2023 Act begin to bind data fiduciaries?

In stages fixed by the commencement notifications issued with the Rules in November 2025, because the Act commences on the dates the Central Government appoints for its provisions. A first block of provisions took effect on notification, including the establishment of the Data Protection Board and the amendment of the Right to Information Act. A second block, including the registration of consent managers, follows twelve months after notification. The principal obligations on data fiduciaries, covering notice and consent in their detailed form, security safeguards, notification of breaches, the protection of children’s data and the additional duties of significant data fiduciaries, apply eighteen months after notification, in May 2027. Until that point the processing of personal data by companies continues to be governed in practice by the Rules of 2011.

Q: What did the successive drafts require when a personal data breach occurred?

The drafts required notification to the regulator; the Act added notification to the individual. Under the draft of 2018 and the Bill of 2019, a data fiduciary that suffered a personal data breach was to notify the Data Protection Authority, which could direct that affected data principals be informed and could require remedial measures, so that the individual’s right to know depended on the regulator’s direction. Section 8 of the Act of 2023 obliges the data fiduciary, on becoming aware of a personal data breach, to inform the Data Protection Board and each affected data principal without delay, and failure to do so is one of the most heavily penalised contraventions in the Schedule. The Rules of 2025 prescribe the form of the intimation and the fuller description of the breach that must follow it, including the facts and circumstances of the event and the measures taken to mitigate its consequences.