The draft Personal Data Protection Bill, 2018, recognises privacy as a fundamental right. It has provisions to protect personal data as an essential facet of information privacy. The objective of the Bill is to balance the growth of the digital economy and use of data as a means of communication between persons with a statutory regime that will protect the autonomy of individuals from encroachments by the state and private entities.
The Bill mandates that data fiduciaries should retain personal data “only as long as may be reasonably necessary to satisfy the purpose for which it is processed”. The Bill allows processing of personal data for “prompt action” only if it is necessary for any function of Parliament; or any State Legislature to render service or benefit to citizens; or in response to any medical emergency to the data principal; or in cases of epidemic, outbreak of disease, disaster or breakdown of public order.