The former Indian DPB, California's CCPA and the European GDPR: A comparative analysis

Abstract

This paper intends to critically analyse the major substantive areas of divergence between India's former draft data protection law (the Data Protection Bill, 2019), the European General Data Protection Regulation and the California Consumer Privacy Act, 2018. The paper further identifies aspects of the General Data Protection Regulation and the California Consumer Privacy Act, 2018 that must be adopted in the Indian context from a business perspective. The Indian government has since withdrawn the Personal Data Protection Bill, 2019 (the 2021 bill containing proposed amendments to the 2019 bill) in light of the severe pushback received from the industry. Instead, the government proposes to create a comprehensive legal framework regulating the entire digital ecosystem, which would also include a new data protection bill that fits into this framework. The authors intend to revisit their observations when this legal framework is published for consultation.