The government on Wednesday approved the personal data protection bill which proposes a penalty of up to Rs 15 crore and up to a three-year jail term for company executives for violating privacy norms.

The bill also mandates storage of critical data of individuals by internet companies within the country while sensitive data can be transferred overseas only after explicit consent of the data owner, a source said.

“Critical data will be defined by the government from time to time,” the source said.

Information and broadcasting minister Prakash Javadekar said the bill has been approved by the cabinet and will be introduced in Parliament during the current Winter Session.

The bill has been drafted following a Supreme Court judgment in August 2017 that declared ‘right to privacy’ a fundamental right.