Significant controls and exemptions to the government under the proposed Digital Personal Data Protection Bill 2022 are likely to make it harder for companies to invest in data centres and data processing activities in India, according to global technology industry body ITI.

The ministry of electronics and IT has floated a draft Digital Personal Data Protection (DPDP) Bill 2022 and has invited comments on the same till January 2.

“The Bill grants significant controls to the executive arm of GoI (government of India) and delegates much of the detailed rulemaking authority to separate, as yet undefined, processes. The GoI is also afforded a broad exemption from the Bill’s application, which could make it harder for companies to invest in data centres and data processing activities in India,” ITI said.

ITI represents global technology majors such as Google, Microsoft, Meta, Twitter and Apple.

The draft DPDP has exempted government-notified data fiduciaries from several compliance burdens such as provisions dealing with informing an individual about the purpose for data collection, collection of children’s data, risk assessment around public order and the appointment of data auditor.

The bill proposes to exempt government-notified data fiduciaries from sharing details of data processing with the data owners under the “right to information about personal data”.

The minister of state for electronics and IT Rajeev Chandrasekhar has said that the exemptions for the government will be only in special circumstances such as maintaining public order, emergency, pandemic and national security.

The industry body, however, has supported the bill on various points such as permission to store data outside India, delineation of roles and responsibilities of entities that determine the purposes and means of the processing of personal data (data fiduciary), and entities that process personal data solely under direction and contract.