Data Protection Bill: Penalty of up to Rs 500 crore for data breach

New Delhi: The government has raised the penalty amount to up to Rs 500 crore for violating provisions under the proposed draft Digital Personal Protection Bill 2022 issued on Friday. The draft personal data protection bill, issued in 2019, had proposed a penalty of Rs 15 crore or 4 per cent of the global turnover of an entity.

"The purpose of this Bill is to provide for the processing of digital personal data in a manner that recognises the right of individuals to protect their personal data, the need to process personal data for lawful purposes and for other incidental purposes," an explanatory note of the draft bill said.

The proposed bill comes in place of the Data Protection Bill, which was withdrawn by the government in August this year. The draft proposes to set up a Data Protection Board of India, which will carry on functions as per the provisions of the bill.

"If the Board determines at the conclusion of an inquiry that non-compliance by a person is significant, it may, after giving the person a reasonable opportunity of being heard, impose such a financial penalty as specified in Schedule 1, not exceeding rupees five hundred crore in each instance," the draft said.

It has proposed a graded penalty system for data fiduciaries that will process the personal data of data owners only in accordance with the provisions of the Act.