A Comparative Analysis of India’s Personal Data Protection Bill 2023 (PDPB) and GDPR

India's Personal Data Protection Bill 2023 (PDPB) and the General Data Protection Regulation (GDPR) are two of the most comprehensive data protection regulations globally. Both aim to safeguard personal data and privacy of individuals, but they differ in several significant aspects. This article delves into the key differences between the PDPB and GDPR.

Introduction to PDPB and GDPR

The Personal Data Protection Bill 2023 (PDPB) was introduced in the Indian Parliament in 2023 and aims to provide a strong data protection regime for individuals within India. The GDPR, on the other hand, is a regulation in European Union (EU) law for the protection and free movement of personal data within the EU.

Key Differences Between PDPB and GDPR

Sensitive Personal Data

One of the notable differences between the PDPB and GDPR is the inclusion of financial data under sensitive personal data. While the GDPR does not specifically include financial data as sensitive personal data, the PDPB explicitly includes it. This expansion is significant as financial data is highly sensitive and can be vulnerable to misuse.

Government Access to Anonymized Data

Another key difference is the government's ability to request the publication of anonymized data under the PDPB. According to the PDPB, the government is entitled to request such data, suggesting a balance between individual privacy and national security or public interest. In contrast, the GDPR does not provide for such provisions, further emphasizing the EU's focus on individual rights and freedoms.

Consent and Processing of Data

Both the PDPB and GDPR require consent for the processing of personal data, but the specifics differ. The GDPR mandates that individuals must give clear and specific consent for data processing, while the PDPB requires that consent be specific, informed, and freely given. However, the PDPB also allows for implied consent in certain situations, which is a notable divergence from the GDPR’s rigid requirement for explicit consent.

Data Portability and Right to Erasure

Data portability and the right to erasure (also known as the right to be forgotten) are fundamental rights under both regulations. However, the PDPB’s implementation of these rights is not as extensive as that under the GDPR. For instance, the PDPB does not guarantee the same level of data portability as the GDPR. Moreover, the PDPB’s provision for the right to erasure is more conditional and limited compared to the GDPR, which offers more robust protection.

Penalties for Breaches

The PDPB and GDPR also differ in their approach to penalties for data breaches. The GDPR comes with steep financial penalties, such as fines of up to 4% of the annual global turnover or €20 million, whichever is greater. In contrast, the PDPB proposes a maximum fine of INR 150 crore (approximately €17 million) for severe data breaches, indicating a more moderate but still significant financial deterrent.

Conclusion

While both the PDPB and GDPR are designed to protect personal data and ensure privacy, they differ significantly in several aspects. The PDPB's inclusion of financial data as sensitive personal data and the government's ability to request anonymized data highlight its unique approach. In contrast, the GDPR's emphasis on individual rights and its stringent penalties set the standard for data protection. Organizations and policymakers must stay informed about these differences to ensure compliance with the relevant regulatory frameworks in the global digital landscape.