India's Data Protection Law Passes Parliament Despite Privacy Concerns

India’s Digital Personal Data Protection Bill of 2023 passed in the lower and upper houses of Parliament and now must be approved by the Indian president before it becomes law.

The bill will allow private companies to transfer some Indian citizens' personal data outside of India while permitting “any instrumentality of the state” to use personal data due to national security and maintaining public order. 

Private companies would be required to obtain consent from their customers or users before processing their personal data, but exceptions are made for “legitimate uses.” However, the government would be able to process Indian citizens' personal data without their express consent.

This is the Indian government's third attempt to pass such a bill and comes almost six years after India's highest court ruled that privacy is a fundamental right of every citizen.