The Ministry of Digital Infrastructure and Information Technology ('MDIIT') announced, on 24 September 2019, that the proposed personal data protection legislation ('the Bill') had been finalised, following a draft framework on the same ('the Framework'). In particular, the MDIIT noted that the Bill would be implemented in stages, and would come into operation within three years from the date it is certified by the Speaker of the Parliament. Moreover, the MDIIT outlined that the data protection authority provided for in the Bill would be established within 18 months.

In addition, the MDIIT highlighted that obligations for the mandatory registration of data controllers have been removed from the Framework, and transparency and accountability requirements have been included instead. Moreover, the MDIIT specified that the accountability requirements stipulate that data controllers should implement internal controls and procedures referred to as a Data Protection Management Program. Furthermore, the MDIIT outlined that would, amongst other things, that the Bill would prohibit data controllers from sending unsolicited messages without express consent, set measures for relationships between data controllers and third parties, and establish data subject rights, such as rights to rectification and to object to data processing. 

In particular, the MDIIT also commented that administrative penalties, as provided for in the Bill, have a ceiling rather than being calculated on the basis of global turnover as orignally contemplated in the Framework.

You can read the MDIIT press release here, and the Bill here.