Comments on the Draft Digital Personal Data Protection Bill, 2022

Submissions to Ministry of Electronics and Information Technology


The Digital Personal Data Protection Bill, 2022 (DPDP Bill), was published by the Ministry of Electronics and IT (MeitY) in November 2022. The DPDP Bill is the latest iteration of India’s data protection legislation after the the Personal Data Protection Bill, 2019 was withdrawn. The Vidhi Centre for Legal Policy has prepared detailed comments in response to multiple issues arising under the DPDP Bill, specifically in relation to:

a. limitations in the definitions;

b. general principles of data protection and grounds of data processing;

c. concepts of notice and consent, and the introduction of a newly created concept of deemed consent;

d. rights of data principals, and the duties of data fiduciaries;

e. enforcement framework, and the contours of the structure and functions of the proposed Data Protection Board of India; and

f. exemptions provided under the DPDP Bill.Vidhi has been at the forefront of initiatives to frame a data protection law in India over the past 5 years.

Vidhi assisted the Srikrishna Committee (with our Research Director, Dr. Arghya Sengupta, being a member of the same) in coming up with the Personal Data Protection Bill, 2018. Since then, Vidhi has continued to work on the issue, publishing a referencer on the Joint Parliamentary Committee’s report of 2021, and also a series of working papers on different issues under the legislative proposals. 

Vidhi’s submissions to MeitY continue to build on its existing work in this space. It is hoped that these comments will be helpful in continuing the discussion on the importance of creating a balanced, robust and holistic data protection regime for India.