Data breach to be reported in 72 hours, held responsible for not doing so

A report of the Joint Committee of Parliament on the Personal Data Protection Bill tabled in Lok Sabha and Rajya Sabha stated that “A mechanism may be devised in which social media platforms, which do not act as intermediaries, will be held responsible for the content from unverified accounts on their platforms. Once an application for verification is submitted with necessary documents, the social media intermediaries must mandatorily verify the account.”

The committee has said there should be only one DPA dealing with privacy and personal data as well as non-personal data, pointing out the impossibility of differentiating the personal and non-personal data, when mass data is collected or transported.

In case of a data leak, the DPA should be notified within 72 hours of the company becoming aware of the breach. The DPA shall then take into account the personal data breach and the severity of harm that may be caused to the persons whose data has been leaked, and accordingly ask the company to report it and “take appropriate remedial measures”.

The Bill was introduced two years ago in the Lok Sabha by former Union Minister Ravi Shankar Prasad and was immediately referred to the standing committee. The committee’s report was presented in the Lok Sabha by its chairperson PP Chaudhary and laid in the Rajya Sabha by Congress MP Jairam Ramesh.