The Centre may exempt some Indian start-ups from the key provisions of the Personal Data Protection Bill at its discretion. 

According to the revised bill seen by businessline, “The Central government may by notification, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including start-ups, as Data Fiduciaries to whom the provisions of section 6, sub-sections (3) and (7) of section 9, sub-sections (1) and (3) of section 10, and sections 11 and 12 of this Act shall not apply.” 

The earlier draft did not mention start-ups specifically. 

Sub sections 3 of 6 refers to the requirement of providing the option to access the information related to taking user consent for processing data in different languages specified in the Eighth Schedule to the Constitution.

Also read: Personal Data Protection Bill may have relaxed cross-border data transfer rules

Sub-sections 7 of 9 refers to the requirement that allows users to withdraw consent and erase past data.

Section 12 allows data principals to seek information related to how data is being processed and details of third party data processors. 

The bill clarifies that the term “start-up” means a private limited company or a partnership firm or a limited liability partnership incorporated in India and is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to start-ups are allocated in the Central government.

Related Topics