CHAPTER I
PRELIMINARY
(1) This Act may be called the Personal Data Protection Act, 2019.
(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint; and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.
The provisions of this Act,—
(A) shall apply to—
(a) the processing of personal data where such data has been collected,
disclosed, shared or otherwise processed within the territory of India;
(b) the processing of personal data by the State, any Indian company, any
citizen of India or any person or body of persons incorporated or created
under Indian law;
(c) the processing of personal data by data fiduciaries or data processors
not present within the territory of India, if such processing is—
(i) in connection with any business carried on in India, or any systematic
activity of offering goods or services to data principals within
the territory of India; or
(ii) in connection with any activity which involves profiling of data
principals within the territory of India.
(B) shall not apply to the processing of anonymised data, other than the anonymised data referred to in section 91.
(13) "data fiduciary" means any person, including the
State, a company, any
juristic entity or any individual who alone or in conjunction with
others determines the
purpose and means of processing of personal data;
(14) "data principal" means the natural person to whom the personal
data relates;
(15) "data processor" means any person, including the
State, a company, any
juristic entity or any individual, who processes personal data on
behalf of a data fiduciary;
(16) "de-identification" means the process by which a data fiduciary
or data processor may remove, or mask identifiers from personal
data, or replace them with such other fictitious name or code that
is unique to an individual but does not, on its own, directly
identify the data principal;
(17) "disaster" shall have the same meaning as assigned to it in
clause (d) of section 2 of the Disaster Management Act, 2005;
(18) "financial data" means any number or other personal data used
to identify an account opened by, or card or payment instrument
issued by a financial institution to a data principal or any
personal data regarding the relationship between a financial
institution and a data principal including financial status and
credit history;
(19) "genetic data" means personal data relating to the inherited or
acquired genetic characteristics of a natural person which give
unique information about the behavioural characteristics, physiology
or the health of that natural person and which result, in
particular, from an analysis of a biological sample from the natural
person in question;
(20) "harm" includes—
(21) "health data" means the data related to the state of physical
or mental health of the data principal and includes records
regarding the past, present or future state of the health of such
data principal, data collected in the course of registration for,
or provision of health services, data associating the data principal
to the provision
of specific health services;
(22) "intra-group schemes" means the schemes approved by the
Authority under clause (a) of sub-section (1) of section 34;
(23) "in writing" includes any communication in electronic format as
defined in
clause (r) of sub-section (1) of section 2 of the Information
Technology Act, 2000;
(24) "journalistic purpose" means any activity intended towards the
dissemination through print, electronic or any other media of
factual reports, analysis, opinions, views or documentaries
regarding—
(i) news, recent or current events; or
(ii) any other information which the data fiduciary believes the
public, or any significantly discernible class of the public, to
have an interest in;
(25) "notification" means a notification published in the Official
Gazette and the expression "notify" shall be construed accordingly;
(26) "official identifier" means any number, code, or other
identifier, assigned to a data principal under a law made by
Parliament or any State Legislature which may be used for the
purpose of verifying the identity of a data principal;
(27) "person" includes—
(i) an individual,
(ii) a Hindu undivided family,
(iii) a company,
(iv) a firm,
(v) an association of persons or a body of individuals, whether
incorporated or not,
(vi) the State, and
(vii) every artificial juridical person, not falling within any of
the preceding sub-clauses;
(28) "personal data" means data about or relating to a natural
person who is directly or indirectly identifiable, having regard to
any characteristic, trait, attribute or
any other feature of the identity of such natural person, whether
online or offline, or any combination of such features with any
other information, and shall include any inference drawn from such
data for the purpose of profiling;
(29) "personal data breach" means any unauthorised or accidental
disclosure, acquisition, sharing, use, alteration, destruction of or
loss of access to, personal data
that compromises the confidentiality, integrity or availability of
personal data to a data
principal;
(30) "prescribed" means prescribed by rules made under this Act;
(31) "processing" in relation to personal data, means an operation
or set of operations performed on personal data, and may include
operations such as collection, recording, organisation, structuring,
storage, adaptation, alteration, retrieval, use, alignment or
combination, indexing, disclosure by transmission, dissemination or
otherwise making available, restriction, erasure or destruction;
(32) "profiling" means any form of processing of personal data that
analyses or predicts aspects concerning the behaviour, attributes or
interests of a data principal;
(33) "regulations" means the regulations made by the Authority under
this Act;
Explanation.— For the purposes of this clause, the expressions,—
(a) "intersex status" means the condition of a data principal who
is—
(i) a combination of female or male;
(ii) neither wholly female nor wholly male; or
(iii) neither female nor male;
(b) "transgender status" means the condition of a data principal
whose sense of gender does not match with the gender assigned to
that data principal at birth, whether or not they have undergone sex
reassignment surgery, hormone therapy, laser therapy, or any other
similar medical procedure;
(37) "significant data fiduciary" means a data fiduciary classified
as such under sub-section (1) of section 26;
(38) "significant harm" means harm that has an aggravated effect
having regard to the nature of the personal data being processed,
the impact, continuity, persistence or irreversibility of the harm;
(39) "State" means the State as defined under article 12 of the
Constitution;
(40) "systematic activity" means any structured or organised
activity that involves an element of planning, method, continuity or
persistence.