(1) This Act may be called the Personal Data and Information Privacy Code Act, 2019.

(2) It extends to the whole of India and, save as otherwise provided in this Act, it applies also to any offence or contravention hereunder committed outside India by any person, wherever located.

(3) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint.

(1) In this Act unless the context otherwise requires,—

(a) “aggregate”, with its grammatical variations and cognate expressions, in relation to personal data, means adding, removing, filtering, mixing, combining or recombining records of data;

(b) “anonymise” means, in relation to personal data, the irreversible removal or alteration of all data that may, whether directly or indirectly in conjunction with any other data, be used to identify a natural person or data subject;

(c) “appropriate Government” means, in relation to the Central Government or a Union territory Administration, the Central Government; in relation to a State Government, that State Government; and, in relation to a public authority which is established, constituted, owned, controlled or substantially financed by funds provided directly or indirectly:—

(i) by the Central Government or a Union territory Administration, the Central Government;

(ii) by a State Government, that State Government;

(d) “authorised officer” means an officer of a competent organization, not below the rank of a Gazetted Officer of an All India Service or a Central Civil Service, as the case may be, who is empowered by the Central Government, by notification in the Official Gazette, to intercept the communications of another person or carry out any surveillance of another person under this Act;

(e) “biometric data” means any data relating to the physical, physiological or behavioural characteristics of a natural person which allows the verification or authentication of that person's identity including, but not restricted to, facial images, fingerprints, hand prints, foot prints, iris recognition, handwriting, typing dynamics, gait analysis and speech recognition;

(f) “Chief Privacy Commissioner” and “Privacy Commissioner” mean the Chief Privacy Commissioner and Privacy Commissioners appointed under section 48;

(g) “collect”, with its grammatical variations and cognate expressions, means, in relation to personal data, any action or activity that results in a person obtaining, or coming into the knowledge or possession of, any personal data of another person, whether directly or indirectly;

(h) “communication” means a word, signs, gestures, spoken, written or indicated, in any form, manner or language, encrypted or unencrypted, meaningful or otherwise, and includes visual representations of words, ideas, symbols and images, and the metadata in relation whether transmitted or not transmitted and, if transmitted, irrespective of the medium of transmission;

(i) “competent organisation” means an organisation authorised by an Act of Parliament to carry out surveillance and/or interception, and includes a public authority as listed in the Schedule.

(j) “consent” means it is free, informed and unambiguous indication of a data subject's agreement;

(k) “data” means shall have some meaning as assigned in it section 2(o) of the Information Technology Act, 2000;

(l) “data controller” means any person including appropriate Government who, either alone, or jointly, or in concert with other persons, determines the purposes for which and the manner in which any personal data is processed;

(m) “data processor” means any person including appropriate Government who processes any personal data on behalf of a data controller;

(n) “data subject” means a natural person who is a citizen under the Citizenship Act, 1955 or who has resided in India for a period of one hundred and eighty two days or more in the twelve months preceding the previous year.

(o) “deoxyribonucleic acid data” means all information, of whatever type, concerning the characteristics of a natural person that are inherited or acquired during early prenatal development;

(p) “destroy”, with its grammatical variations and cognate expressions, means, in relation to personal data, to cease the existence of, by deletion, erasure or otherwise, any personal data which becomes irretrievable in whole or in part, including information about the existence of such data itself;

(q) “disclose”, with its grammatical variations and cognate expressions, means, in relation to personal data, any action or activity that results in a person coming into the knowledge or possession of any personal data of another person;

(r) “interception” or “intercept” means any activity intended to capture, read, listen to or understand the communication of a person;

(s) “officer-in-charge of a police station” shall have the meaning ascribed to it under clause (o) of section 2 of the Code of Criminal Procedure, 1973;

(t) “person” includes a natural person or legal person including a company, a firm, an association of persons, a public authority or a body of individuals, wherever located, whether incorporated or not;

(u) “personal data” means any data which relates to a natural person if that person can, whether directly or indirectly in conjunction with any other data, be identified or identifiable from it and includes sensitive personal data:

Provided that the term “personal data” shall not include data which is a matter of public record except details of victims in cases of sexual assault, kidnapping or abduction.

(v) “prescribed” means prescribed by rules and regulations made under this Act;

(w) “Privacy Commission” means the body constituted under sub-section (1) of section 47;

(x) “Privacy Officer” means the Privacy Officer designated under sub-section (3) of section 36 and sub-sections (3) and (4) of section 43;

(y) “process”, with its grammatical variations and cognate expressions, means, in relation to personal data, any action or operation which is performed upon personal data of another person, whether or not by automated means including, but not restricted to, collection, aggregation, organisation, structuring, adaptation, modification, retrieval, consultation, use, alignment or destruction;

(z) “public authority” shall have the meaning assigned to it under clause (h) of section 2 of the Right to Information Act, 2005;

(za) “receive”, with its grammatical variations and cognate expressions, means, in relation to personal data, to come into the knowledge or possession of any personal data of another person;

(zb) “sensitive personal data” means data or metadata as to a person's—

(i) biometric data;

(ii) deoxyribonucleic acid data;

(iii) identification number, or any identity attributes;

(iv) location data;

(v) sexual preferences and practices;

(vi) medical history and health information;

(vii) political affiliation or opinions;

(viii) present and past membership of a political, cultural, social organisations including but not limited to a trade union as defined under section 2(h) of the Trade Union Act, 1926;

(ix) ethnicity, religion, race or caste; and

(x) financial and credit information, including financial history and transactions except in cases of public officials or when such information is considered as a public record or its disclosure is made under any law.

(zc) “State Privacy Commission” means the body constituted under sub-section (1) of section 65;

(zd) “Surveillance and Interception Review Division” means the bodies constituted under sub-section (1) of section 70;

(ze) “store”, with its grammatical variations and cognate expressions, means, in relation to personal data, to retain, in any form or manner and for any purpose or reason, any personal data of another person;

(zf) “surveillance” means any activity, directly or indirectly intended to watch, monitor, record or collect, or to enhance the ability to watch, record or collect, any information, images, signals, data, movement, behaviour or actions, of a person, a group of persons, a place or an object, for the purpose of obtaining information about a person and their private affairs, including:

(i) directed surveillance that is covert surveillance undertaken for a specific investigation or operation even if the person surveilled was not specifically identified in relation to the surveillance operation;

(ii) inclusive surveillance which is covert surveillance carried out by an individual or surveillance device in relation to anything taking place in any private premises or private vehicle;

(ii) covert human intelligence gathering which is information obtained by a person who establishes or maintains a personal or other relationship with a person for a covert purpose of using it to obtain access to any personal information about that individual;

(iv) surveillance undertaken through installation and use of CCTV and other system which capture audio-visual information to identify or monitor individuals; but does not include collection of personal data under sections 7, 11 and 12.

All other words expressions used herein but not defined and defined in the General Clauses Act, 1897 or the Code of Criminal Procedure, 1973 as the case may be, shall have the same meanings as assigned to them in those Acts.

All provisions of Chapter III shall apply to personal data collected, processed, stored, transferred or disclosed by competent organizations unless specifically provided or exempted under this Chapter;

(2) A competent organization seeking to exclude the application of provisions of Chapter III with respect to all categories of personal data collected, processed, stored, transferred or disclosed by itself, shall prefer an application with the Privacy Commission, in a manner prescribed by the Privacy Commission.

(3) An application under sub-section (2) shall specify—

(a) the specific personal data sought to be exempted from provisions of Chapter III of this Act;

(b) the reasons as to why surveillance under this provision is necessary to prevent a reasonable threat to security of the State or public order :

Provided that the reasons shall also state why the data covered under the request for exemption has a reasonable, proximity and direct nexus with the threat:

Provided further that the reasons shall specify why a lesser restrictive measure may not be taken; and

(c) the specific time period during which the exemption is sought.

(4) No competent organisation shall process or store any personal data without implementing measures to ensure that the number of persons within that intelligence organisation to whom it is made available, and the extent to which it is copied, is limited to the minimum that is necessary to fulfill the purpose for which it is processed or stored, as the case may be.

(5) Notwithstanding any provisions of the Indian Evidence Act, 1872 any personal data collected, processed, stored, transferred or disclosed by a competent organization in contravention of this Act shall be inadmissible in legal proceedings before any court of law.

Notwithstanding anything contained in any other law for the time being in force, but save as provided in this chapter, no person shall intercept, or cause to be intercepted, any communication of another person person except in pursuance of an order by the appropriate Surveillance and Interception Review Division.

No interception of any communication shall be ordered or carried out that is not necessary to achieve the purpose for which the interception is sought.

An authorised officer of a competent organisation seeking to intercept any communication of another person shall prefer an application, in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, to the appropriate Surveillance and Interception Review Division.

The appropriate Surveillance and Interception Review Division may, if it is satisfied that the interception is necessary to prevent a reasonable threat to security of the State or public order, or prevent, investigate or prosecute a cognisable offence, order the interception of communications by recording reasons in writing.

The appropriate Surveillance and Interception Review Division shall, prior to issuing an order for interception of any communication, satisfy itself that all other lawful means to acquire the information sought to be intercepted have been exhausted and that the proposed interception is necessary and proportionate, reasonable and not excessive.

Any interception of any communication ordered, authorised or carried out prior to the commencement of this Act shall, immediately upon the constitution of the Privacy Commission, be reported to the Office for Surveillance Reform of the Privacy Commission.

Any interception involving the infringement of the privacy of individuals who are not the subject of the intended interception, or where communications relate to journalistic, activism related to fundamental and constitutional rights, parliamentary or legally privileged material is involved, it shall satisfy additional conditions including the provision of specific prior justification in writing to the Office for Surveillance Reform of the Privacy Commission as to the necessity for the interception and the safeguards providing for minimizing the material intercepted to the greatest extent possible and the destruction of all such material that is not strictly necessary for the purpose of the interception.

Notwithstanding anything contained in section 31, if the Home Secretary of the appropriate Government is satisfied that an imminent grave threat to the security of the State or public order exists, he may, for reasons to be recorded in writing, order the interception of any communication.

No order for interception of any communication made under this section shall be valid upon the expiry of a period of seven days from the date of the order.

Before the expiry of a period of seven days under this section, the person who carried out the interception of communication shall notify the appropriate Surveillance and Interception Review Division of the fact of such interception, the name and address of the person whose communication is being intercepted, and the duration of the interception and, furthermore, shall furnish a copy of the order of the Home Secretary authorising the interception.

The surveillance and Interception Review Division may, upon receipt of notification under sub-section (3), recall the order on grounds of lack of an imminent and grave threat to the security of State or public order, or on absence of ground mentioned in sub-section (2) of section 31, and may also order for damages in case of abuse to be paid to the individual/ natural person whose communication was intercepted under the order so recalled.

An order for interception of any communication shall specify the period of its validity and upon the expiry of the period of validity of all interception carried out in relation to that order shall cease forthwith:

Provided that no order for interception of any communication shall be valid upon the expiry of a period of thirty days from the date of the order.

The appropriate Surveillance and Interception Review Division, may, upon receipt of an application from an authorised officer in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, renew, for a period not exceeding thirty days, any order for interception of any communication if it is satisfied that the conditions upon which the original order was issued continue to exist:

Provided that where interception of communication, under orders passed under this Chapter, including orders for renewal, has been carried out for a cumulative period of six months, whether in succession or not, any application for further renewal, shall be accepted, if in addition to the ground mentioned in this sub-section, the competent organization is able to demonstrate the need for such continued interception.

Subject to sub-section (2), before the expiry of a period of thirty days from the conclusion of any interception of communication ordered or carried out under this Act or any interception of communication carried out before the Act came into force, the authorised officer who carried out the interception of communication shall, in writing in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, notify, with reference to the relevant order of the Surveillance and Interception Review Division, each person whose communication was intercepted of the fact of such interception and duration thereof.

The Surveillance and Interception Review Division may, on an application made by an authorised officer in such form and manner as may be prescribed, if he is satisfied that the person(s) specified in notification under sub-section (1) poses a reasonable threat to the security of the State or public order or adversely affect the prevention, investigation or prosecution of a cognisable offence, for reasons to be recorded in writing addressed to the authorised officer, order that such person(s) whose communication was intercepted not be notified of the fact of such interception or the duration thereof:

Provided that any order passed preventing disclosure of interception under section (2) shall not operate in infinity and shall record reasons in writing with the period till when the reasonable threat is anticipated to extend, on cessation of which the duty to inform under sub-section (1) shall operate.

Any person who carries out any interception of any communication, or who obtains any information, including personal data, as a result of an interception of communication, shall have a duty of data security and privacy with respect to it.

No person shall intercept any communication of another person without implementing measures, including, but not restricted to, technological, physical and administrative measures, to secure the data security and privacy of all information obtained as a result of an interception of communication, including from theft, negligence, loss or unauthorised disclosure.

Every competent organisation shall, before the expiry of a period of one hundred days from the enactment of this Act, designate as many officers as it deems fit as Privacy Officers who shall be administratively responsible for ensuring that all interceptions of communications carried out by that competent organisation are in compliance with the provisions of this Chapter.

In addition to the existing obligations and duties for lawful interception, no person shall disclose to any person, other than the person whose communication has been intercepted, or otherwise cause any other person to come into the knowledge or possession of, the content or nature of any information, including personal data, obtained as a result of an interception of any communication including the fact that the interception of communication was carried out.

Notwithstanding anything contained in this section, if the disclosure of any information, including personal data, obtained as a result of an interception of any communication is necessary to prevent a reasonable threat to the security of the State or public order, or prevent, investigate or prosecute a cognisable offence, an authorised officer may disclose the information, including personal data, obtained as a result of the interception of any communication to any authorised officer of any other competent organization:

Provided that no authorised officer shall disclose any information, including personal data, obtained as a result of the interception of any communication that is not necessary to achieve the purpose for which the disclosure is sought.

Subject to sub-section (2), no person shall store any data, including personal data, obtained as a result of an interception of any communication for a period longer than one hundred and eighty days from the date on which the last order for interception of the communication to which the obtained information pertains expired and upon expiry of such period, shall destroy the data so stored.

The Surveillance and Interception Review Division may, on an application made in such form and manner as may be prescribed by the Privacy Commission, if it is satisfied that it is necessary to—

(a) prevent a reasonable threat to the security of the State; or

(b) maintain public order; or

(c) prevent, investigate or prosecute a cognisable offence in an ongoing legal proceeding and is authorized by a court order to that effect;

for reasons to be recorded in writing, order that any information, including personal data, obtained as a result of an interception of any communication may be stored for a period longer than one hundred and eighty days from the date on which the last order for interception of the communication to which the obtained information pertains expired and shall not be destroyed.

Any data obtained as a result of interception of any communication shall be stored in a manner that complies with the provisions of Section 15 with respect to such data.

Notwithstanding anything contained in any other law for the time being in force, but save as provided in this chapter, no person shall order or carry out, or cause or assist the ordering or carrying out of, any surveillance of another person.

The appropriate Surveillance and Interception Review Division shall have the power to issue appropriate directions, including for cessation of any activity, being carried out by a person, including a statutory authority, which is in contravention of the proviso to sub-section (1).

No member of a competent organization shall order or carry out, or cause to be ordered or carried out, any surveillance of another person save in pursuance of an order by the appropriate Surveillance and Interception Review Division.

No surveillance shall be ordered or carried out that is not necessary to achieve the purpose for which the surveillance is sought.

An authorised officer seeking to carry out any surveillance of another person shall prefer an application, in such form and manner as may be prescribed by Central Government in consultation with the Privacy Commission, to the Surveillance and Interception Review Division.

The Surveillance and Interception Review Division may, if it is satisfied that the surveillance is necessary to prevent a reasonable threat to the security of the State or public order, or to prevent, investigate or prosecute a cognisable offence, for reasons to be recorded in writing addressed to the authorised officer, order the surveillance.

Notwithstanding anything contained in any other law for the time being in force, and without prejudice to the provisions of section 37 of this Act, no person who is not a member of a competent organization shall carry out, or cause to be carried out, any surveillance in any public place or in any property or premises that is not in his possession.

Without prejudice to sub-section (1), any person who carries out any surveillance under this section shall be subject to a duty to inform, in such manner as may be prescribed by the Central Government in consultation with the Privacy Commission, members of the public of such surveillance.

An order for surveillance shall specify the period of its validity and, upon the expiry of the validity of the order, all surveillance carried out in relation to that order shall cease forthwith:

Provided that no order for surveillance shall be valid upon the expiry of a period of thirty days from the date of the order.

The Surveillance and Interception Review Division may, upon receipt of an application from an authorised officer in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, renew any order for surveillance if it is satisfied that the conditions upon which the original order was issued continue to exist.

Provided that where surveillance, under orders passed under this Chapter, including orders for renewal, has been carried out for a cumulative period of six months, whether in succession or not, any application for further renewal, shall be accepted, if in addition to the ground mentioned in this sub-section, the competent organization is able to demonstrate the need for such continued surveillance.

Subject to sub-section (2), before the expiry of a period of thirty days from the conclusion of any surveillance ordered or carried out under this Act or any surveillance carried out before this Act came into operation, the authorised officer who carried out the surveillance shall, in writing in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, notify, with reference to the relevant order of the Surveillance and Interception Review Division, each person in respect of whom surveillance was carried out of the fact of such surveillance and duration thereof.

The appropriate Surveillance and Interception Review Division may, on an application made by an authorised officer in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, if it is satisfied that the notification under sub-section (1) would present a reasonable threat to the security of the state or public order, or adversely affect the prevention, investigation or prosecution of a cognisable offence, for reasons to be recorded in writing addressed to the authorised officer, order that the person not be notified of the fact of such surveillance or the duration thereof:

Provided any order passed preventing disclosure of surveillance under Section (2) shall not operate indefinitely and shall record reasons in writing with the period till when the reasonable threat is anticipated to extend, on cessation of which the duty to inform under sub-section (1) shall operate.

Any person who carries out any surveillance, or who lawfully obtains any information, including personal data, as a result of surveillance, shall be subject to a duty of confidentiality and secrecy in respect of it.

No person shall carry out any surveillance of another person without implementing measures, including, but not restricted to, technological, physical and administrative measures, to secure the confidentiality and secrecy of all information obtained as a result of surveillance, including from theft, loss or unauthorised disclosure.

Every competent organization shall, before the expiry of a period of one hundred days from the enactment of this Act, designate as many officers as it deems fit as Privacy Officers who shall be administratively responsible for ensuring that all surveillance carried out by the Competent Organization are in compliance with the provisions of this Chapter:

Provided that a public authority that does not order or carry out surveillance shall not be required to designate any Privacy Officers under this sub-section.

Every person who is not a member of a competent organization and who seeks to carry out any surveillance shall, at least seven days before the surveillance is first carried out, designate or appoint as many persons as it deems fit as Privacy Officers who shall be responsible for ensuring that all surveillance carried out is in compliance with the provisions of this Chapter:

Provided that where surveillance is carried out by a single person, that person shall be deemed to be a Privacy Officer.

In addition to the existing obligations and duties for lawful, no person shall disclose to any person, other than the person who is being surveilled, or otherwise cause any other person to come into the knowledge or possession of, the content or nature of any information, including personal data, obtained as a result of any surveillance including the fact that the surveillance was carried out.

Notwithstanding anything contained in this section, if the disclosure of any information, including personal data, obtained as a result of surveillance is necessary to prevent a reasonable threat to the security of the State or public order, or prevent, investigate or prosecute a cognisable offence, that information, including personal data, obtained as a result of surveillance may be disclosed to an authorized officer of a competent organization only:

Provided that no person shall disclose any information, including personal data, obtained as a result of surveillance that is not necessary to achieve the purpose for which the disclosure is sought.

Subject to sub-section (2), no person shall store any information, including personal data, obtained as a result of surveillance for a period longer than one hundred and eighty days from the date on which the surveillance to which the obtained information pertains ceased, and upon expiry of such period, shall destroy the data so stored.

The appropriate Surveillance and Interception Review Division may, on an application made in such form and manner as may be prescribed by the Central Government in consultation with the Privacy Commission, if it is satisfied that it is necessary to—

(a) prevent a reasonable threat to the security of the State; or

(b) public order; or

(c) prevent, investigate or prosecute a cognisable offence in an ongoing legal proceeding and is authorized by a court order to that effect;

for reasons to be recorded in writing, order that any information, including personal data, obtained as a result of surveillance may be stored for a period longer than one hundred and eighty days from the date on which the last order for surveillance to which the obtained information pertains expired and shall not be destroyed.

Any data obtained as a result of surveillance shall be stored in a manner that complies with the provisions of Section 14 with respect to such data.

Any communication, complaint, or evidence thereunder alleging violation of the provisions of this Act or other applicable law, if made to the Privacy Commission, the Surveillance and Interception Review Divisions and their legal counsel, or to the Supreme Court, shall not be treated as a violation of this Act and applicable provisions of the Information Technology Act, 2000.

The Central Government shall, by notification, issued within 6 months of the enactment of this Act, constitute, with immediate effect, a body to be called the Privacy Commission, by warrant under its hand and seal, to exercise the jurisdiction and powers and discharge the functions and duties conferred or imposed upon it by or under this Act.

The Privacy Commission shall be composed of at least three Privacy Commissioners, to be appointed by the President as specified by this Act.

The Privacy Commission shall consist of two coordinate offices, namely the Office for Data Protection and the Office for Surveillance and Interception Reform, and such officers, other employees, and experts as may be appointed in accordance with the provisions of this Act.

The Privacy Commission shall be autonomous, independent, and free from external interference. It shall be provided with suffcient operational resources including human, technical, and financial for the effective discharge of its duties and exercise of its powers. Such powers shall be subject to audit by the Comptroller and Auditor General of India.

The exercise of financial powers shall be subject to audit by the Comptroller and Auditor General of India.

The Privacy Commission shall consist of one Chief Privacy Commissioner and two or more than two Privacy Commissioners as may be deemed necessary:

Provided that at least one Privacy Commissioner shall be a person who has been a Judge of the Supreme Court or has been a Chief Justice or Acting Chief Justice of a High Court:

Provided further that at least one or more Privacy Commissioner shall be a woman or a member of the third gender, or a transgender:

Provided also that at least one or more Privacy Commissioner shall belong to a —

(i) socially or educationally backward classes; or

(ii) Scheduled Caste; or

(iii) Scheduled Tribe; or

(iv) minority.

(2) The Chief Privacy Commissioner and the Privacy Commissioners shall be persons of outstanding ability, impeccable integrity and standing and who have special knowledge of, technical expertise in, and professional or academic experience, of not less than ten years cumulatively, in any one or more of the following domains—

(a) privacy law and policy;

(b) business and human rights;

(c) civil liberties;

(d) engineering, technology, design and ethics; or

(e) data collection, storage and protection practices, including emerging technologies.

(3) The Central Government shall issue a public advertisement inviting applications to fill all vacancies in the Privacy Commission.

(4) The selection committee for the appointment of the members of the Privacy Commission, shall be constituted by the President of India and the selection panel shall consist of the following, namely :—

(a) collegium of the Supreme Court of India;

(b) the Law Minister;

(c) the Leader of the Opposition in Lok Sabha or of the single largest opposition party being one with the greatest numerical strength in the Lok Sabha;

(d) Director of Indian Institute of Science;

(e) Director of an Indian Institute of Technology as appointed by the IIT Council;

(f) one eminent person representing the private sector; and

(g) one eminent person representing the civil society.

Explanation.—The term 'civil society' mean non-Governmental and non-profit organisations that engage in the general upliftment and interests of the people in the field of privacy and is independent of Government funding, interference or influence.

(5) All proceedings of the selection committee shall be matters of public record and subject to pro-active disclosures under the Right to Information Act, 2005.

(6) No Members of Parliament or Members of the Legislature of any State or Union territory having Legislative Assembly or a member of any political party shall be eligible for

selection or appointment as a Chief Privacy Commissioner or Privacy Commissioner:

Provided that persons holding any other office of profit or carrying on any business or practising any profession, before he enters upon this office, shall be eligible for appointment or selection as Chief Privacy Commissioner or Privacy Commissioner, as the case may be, if—

(a) he holds any office of trust or profit, resigns from such office; or

(b) he is carrying on any business, severs his connection with the conduct and management of such business; or

(c) she is practising any profession, ceases to practise such profession.

The office for Data Protection of the Privacy Commission shall be consisted of a Director General of Data Protection, to be appointed by Privacy Commission through a notification, who shall be a person of standing, ability and integrity, qualified in the field of law and with professional experience of not less than five years, cumulatively, in one or more of the following domains:

(a) investigation;

(b) criminal procedure;

(c) cybercrime and cyber forensics; and

(d) privacy and transparency law and policy.

(2) The number of other Additional Director General, Joint Director- General, Deputy Director-General or Assistant Directors General or such officers or other employees in the office of Data Protection, under the Director General, and the manner of their appointments, shall be such as may be prescribed by the Privacy Commission.

(3) Every Additional Director General, Joint Director-General, Deputy Director-General and Assistant Directors General or such officers or other employees, shall exercise such powers, and discharge functions, subject to the general control, supervision and direction of the Director General.

(4) The Additional Director General, Joint Director-General, Deputy Director-General or Assistant Directors General or such officers of other employees, shall be appointed from amongst persons of integrity, ability and standing, and who have experience in law, investigation, public administration, economics and possess such other qualifications as may be prescribed by the Privacy Commission.

The Office for Surveillance and Interception Reform of the Privacy Commission shall consist of a Director General of Surveillance and Interception Reform, to be appointed by the Privacy Commission through a notification, who shall be a person of ability, integrity and standing, qualified in law and with professional experience of not less than five years, cumulatively, in any or more of the following domains —

(a) civil liberties;

(b) criminal procedure;

(c) Governmental transparency, oversight and accountability;

(d) police reforms.

(2) The number of other Additional Director General, Joint Director General, Deputy Director General or Assistant Directors General or such officers or other employees in the Office of Data Protection, under the Director General, and the manner of their appointments, shall be such as may be prescribed by the Privacy Commission.

(3) Every Additional Director General, Joint Director General, Deputy Director General and Assistant Directors General or such officers or other employees, shall exercise his powers, and discharge his functions, subject to the general control, supervision and direction of the Director General.

(4) The Additional Director General, Joint Director General, Deputy Director General or Assistant Directors General or such officers of other employees, shall be appointed from amongst persons of integrity, ability and standing, and who have experience in law, investigation, public administration, economics and such other qualifications as may be prescribed by the Privacy Commission.

The Privacy Commission may appoint such officers and other employees as it considers necessary for its efficient functioning under this Act.

(2) The Privacy Commission may engage such number of experts and professionals of integrity and outstanding ability, who have special knowledge of, and experience in, data, transparency, information, law, technology, economics or such other disciplines related to privacy, as it deems necessary to assist the Commission in the discharge of its functions under this Act.

(3) The salaries and allowances payable to and other terms and conditions of service of the officers and other employees of the Commission and the number of such officers and other employees shall be such as may be prescribed by the Privacy Commission.

Before appointing any person as a Chief Privacy Commissioner or Privacy Commissioner, the President shall satisfy himself that the person does not, and shall not have any such financial or other interest as is likely to affect prejudicially their functions as such Chief Privacy Commissioner or Privacy Commissioner.

(2) The Chief Privacy Commissioner and every Privacy Commissioner shall hold office for such period, not exceeding five years, as may be specified by the President in the order of his appointment, but shall be eligible for reappointment:

Provided that no person shall hold office as a Chief Privacy Commissioner or Privacy Commissioner for more than two terms:

Provided further that no person shall hold office as a Chief Privacy Commissioner or Privacy Commissioner, as the case may be, after he has attained the age of seventy-five years.

(3) Notwithstanding anything contained in sub-section (2), a Chief Privacy Commissioner or any Privacy Commissioner may —

(a) by writing under his hand and addressed to the President resign his office at any time;

(b) be removed from office in accordance with the provisions of section 53 of this Act.

(4) A vacancy caused by the resignation or removal of a Chief Privacy Commissioner or Privacy Commissioner under sub-section (3) shall be filled by fresh appointments.

(5) In the event of the occurrence of a vacancy in the office of a Chief Privacy Commissioner, such one of the Privacy Commissioners as the President may, on the advice of the selection committee under section 48(3), by notification, authorise in this behalf, shall act as the Chief Privacy Commissioner till the date on which a new Chief Privacy Commissioner, is appointed in accordance with the provisions of this Act, to fill such vacancy, enters upon his office.

(6) When a Chief Privacy Commissioner is unable to discharge his functions owing to absence, illness or any other cause, such one of the Privacy Commissioners as the Chief Privacy Commissioner may authorise in writing in this behalf shall discharge the functions of the Chief Privacy Commissioner, till the date on which the Chief Privacy Commissioner resumes his duties.

(7) The salaries and allowances payable to and the other terms and conditions of service of a Chief Privacy Commissioner and Privacy Commissioners shall be the same as that of the Chief Election Commissioner and Election Commissioners respectively:

Provided that neither the salary and allowances nor the other terms and conditions of service of a Chief Privacy Commissioner or any Privacy Commissioner shall be varied to their disadvantage after their appointment.

(8) The salaries and allowances payable to and the other terms and conditions of service of the Director General of Data Protection, the Director General of Surveillance, any Additional Director General, Joint Director General, Deputy Director General or Assistant Director General, Secretary, officer, employee appointed or expert or professional engaged shall be such as may be prescribed by the Privacy Commission.

(9) The Chief Privacy Commissioners and Privacy Commissioners on ceasing to hold office as such shall not hold any appointment under the Government of India or under the Government of any State for a period of ten years from the date on which they cease to hold such office.

The President may remove from office the Chief Privacy Commissioner or any Privacy Commissioner, who –

1. is adjudged an insolvent; or
2. engages during his term of office in any paid employment outside the duties of his office; or
3. is unfit to continue in office by reason of infirmity of mind or body; or
4. is of unsound mind and stands so declared by a competent court; or
5. is convicted for an offence which in the opinion of the President involves moral turpitude; or
6. has acquired such financial or other interest as is likely to affect prejudicially her functions as a Chief Privacy Commissioner or Privacy Commissioner, or cause some conflict of interest including benefits directly or indirectly to relatives or family members, or
7. has so abused his position as to render his continuance in offence prejudicial to the public interest.

Notwithstanding anything contained in sub-section (1), neither a Chief Privacy Commissioner nor any Privacy Commissioner shall be removed from his office on the ground specified in clause (f) or clause (g) of that sub-section unless the Supreme Court on a reference being made to it in this behalf by the President, has on an inquiry held by it in accordance with such procedure as it may specify in this behalf, reported that the Chief Privacy Commissioner or Privacy Commissioner ought, on such grounds, to be removed.

The Privacy Commission may, through decisions arrived at by a simple majority of its members present and voting as set out in section 59(1) of this Act, authorize, review, investigate, make an inquiry, and/or monitor, suo motu or on a petition presented to it by any person, group of persons or by someone acting on his or their behalf, the implementation and application of this Act and give such directions or pass such orders as are necessary for reasons to be recorded in writing.

(2) Without prejudice to the generality of the foregoing provision, the Privacy Commission shall perform the following functions, namely —

(a) review the safeguards provided under this Act or under other laws for the time being in force for the protection of personal data and recommend measures for their effective implementation or amendment, as may be necessary from time to time;

(b) review and/or monitor any measures taken by any competent organization, company, person or other entity for the protection of privacy and take such further action as it deems fit;

(c) authorize, review and/or monitor any action, code, certification, policy or procedure of any competent organisation, company, person or other entity to ensure compliance with the provisions of this Act and rules made hereunder;

(d) enforce the provisions of this Act at its own or on the basis of complaints received by it or by way of issuing of appropriate orders and directions, the pursuit of binding settlements with offending persons and the levy of fines;

(e) formulate, through transparent, inclusive and pervasive public consultations with experts, other stakeholders, and the general public, norms and rules for the effective protection of privacy by competent organisations, companies, persons or other entities;

(f) promote awareness and knowledge of personal data protection through any means necessary and to all stakeholders with special attention to children, including providing information to any data subject regarding their rights under this Act as requested and undertaking training and knowledge building for data controllers, including those involved in the provision of essential services and law enforcement;

(g) undertake and promote research in the field of protection of personal data and privacy;

(h) encourage the efforts of non-Governmental organisations and institutions working in the field of personal data protection and privacy;

(i) ensure the speedy and efficient redressal of all complaints, whether made by a data subject or a group of data subjects or on their behalf, whose cause of action arises on implementation of this Act;

(j) undertake efforts to facilitate international co-operation with regards to data protection, and allied subjects, including enforcement;

(k) advise the Central Government on the grant of adequacy status in respect of cross border data flows;

(l) co-ordinate in writing across State Privacy Commissions, State Governments and regulatory bodies including the Bureau of Indian Standards which may also be concerned with data protection in order to harmonize and classify standards for data including open data sets which contain personal data;

(m) such other functions as it may consider necessary for the protection of privacy, personal data, the prevention of the abuse of the criminal process, both investigatory and judicial, by the State, and enforcement of this Act;

(n) make a public, freely available publication of annual reports providing description of performance, findings, conclusions or recommendations of any or all of the functions assigned to the Privacy Commission in this Chapter.

(3) Without prejudice to the generality of the foregoing provision, the Office of Data Protection within the Privacy Commission shall perform the following functions, namely:—

(a) investigate data controllers and processors, whether initiated on complaint of a data subject or a group of them or on their behalf or on direction of the Privacy Commission or suo motu, for the purpose of identifying activities which are in contravention of the provisions of this Act, either at its own instance or upon receipt of credible information or complaint;

(b) obtain access from data controllers and processors, to all personal data and to all information necessary for the performance of its tasks.

(c) publish and make publicly available periodic reports concerning the incidence of compliance including violations of this Act and data breaches as reported under this Act;

(d) assist the Privacy Commission in policy formulation and other activities for effective protection of privacy;

(e) coordinate with the office for Surveillance and Interception Reform in such manner as is necessary or may be useful to the achievement of the purposes of this Act;

(4) Without prejudice to the generality of the foregoing provision, the Office for Surveillance and Interception Reform in the Privacy Commission shall perform the following functions, namely:

(a) assist the Privacy Commission in the formulation of policy and other activities for bringing about reforms in carrying out interception and surveillance by competent organization, companies, persons or other entities;

(b) collection of data from competent organizations on interception and surveillance carried out by those and analyze the same for the purpose of preparing periodic reports on compliance with provisions of this Act, including comprehensive data concerning violations of the processes of interception of communications and surveillance;

(c) advise on appointments of Public Advocates, as provided under sub-section

(4) of section 70, for the purpose of defending the person being surveilled or intercepted before the Surveillance and Interception Review Division;

(d) to appear before a Surveillance and Interception Review Divisions to provide expert evidence and testimony;

(e) ensure the speedy and efficient redressal of all complaints, whether made by a data subject or a group of data subjects or in their behalf, whose cause of action arises from this Act;

(f) co-ordinate with the office of Data Protection in such manner as is necessary or may be useful to the achievement of the purposes of this Act;

(5) The Periodic Reports published by the Privacy Commission, stipulated under sub- section 3(c) of section 54, shall be tabled before both Houses of Parliament during the Parliamentary Session that succeeds the publication of any Periodic Report and the same shall be made publicly available, immediately thereafter.

(6) The Chief Privacy Commissioners, Privacy Commissioners and Directors General shall appear before a special ad hoc Committee, constituted by the Speaker of the Lok Sabha and comprising of members from both the governing and the opposition parties from both Houses of Parliament, on a quarterly basis and the ad hoc Committee shall—

(a) be empowered to review the functioning of the Privacy Commission, and may ask the Chief Privacy Commissioners and the Privacy Commissioners any questions in this regard, as per procedure of the functioning of the Committee.

(b) prepare and present periodic reports to both Houses of Parliament in a manner regulated by the Committee; and

(c) held its sitting in public in order to ensure transparency and inclusive participation.

(7) Subject to the provisions of any rules prescribed in this behalf by the Central Government, the Privacy Commission shall have the power to review any decision, judgment, decree or order made by it.

(8) In the exercise of its functions under this Act, the Privacy Commission shall give such directions or pass such orders as are necessary for reasons to be recorded in writing.

(9) The Privacy Commission may, in its own name, sue or be sued.

The salaries and allowances payable to the Chief Privacy Commissioners, Privacy Commissioners, Director Generals, any Additional, Joint, Deputy or Assistant Director General, Secretary, officer, employee appointed or expert or professionals engaged and the administrative expenses of the Privacy Commission shall be defrayed out of the Consolidated Fund of India.

No act or proceeding of the Privacy Commission shall be questioned on the ground merely of the existence of any vacancy or defect in the constitution of the Privacy Commission or any defect in the appointment of a person acting as the Chief Privacy Commissioner or Privacy Commissioner.

The Chief Privacy Commissioners and Privacy Commissioners and other employees of the Privacy Commission shall be deemed to be public servants within the meaning of section 21 of the Indian Penal Code, 1860 (45 of 1860).

The Privacy Commission shall be located in New Delhi or in such other location as directed by the Chief Privacy Commissioner in consultation with the Central Government.

Investigations or actions for enforcement may be instituted in the Privacy Commission, suo motu or on complaints made by any person, group of persons or anyone on their behalf, in respect of cases involving–

1. data collection or processing by or on behalf of the Central Government;
2. a conflict between two State Privacy Commissions; or
3. extraterritorial transfers of data pertaining to Indian data subjects.

Any disputes as to jurisdiction shall be resolved in a manner that would accord the data subject the most timely and cost-effective access to redress, or promote the most timely and cost effective enforcement of the provisions of this Act.

Subject to the provisions of this Act, the Privacy Commission, in coordination with both Offices constituted under it, shall have power to make rules to prescribe –

1. the procedure and conduct of its business;
2. the delegation to one or more Privacy Commissioners of such powers or functions as the Privacy Commission may specify.

In particular and without prejudice to the generality of the foregoing provisions, the powers of the Privacy Commission shall include the power to determine the extent to which persons interested or claiming to be interested in the subject-matter of any proceeding before it may be allowed to be present or to be heard, either by themselves or by their representatives or to crosser-examine witnesses or otherwise take part in the proceedings:

Provided that any such procedure as may be prescribed or followed shall be guided by the principles of natural justice.

Nothing in this section shall prevent either Office in the Privacy Commission from making rules in respect of matters of procedure exclusively concerning it.

The Privacy Commission, including offices constituted under it, shall, for the purposes of any inquiry or for any other purpose under this Act, have the same powers as vested in a civil court under the Code of Civil Procedure, 1908 (5 of 1908), while trying suits in respect of the following matters, namely –

1. the summoning and enforcing the attendance of any person from any part of India and examining him on oath;
2. the discovery and production of any document or other material object producible as evidence;
3. the reception of evidence on affidavit;
4. the requisitioning of any public record from any court or office;
5. the issuing of any commission for the examination of witnesses; and,
6. any other matter which may be prescribed by the Central Government.

The Privacy Commission shall have power to require any person, subject to any privilege which may be claimed by that person under any law for the time being in force, to furnish information on such points or matters as, in the opinion of the Privacy Commission, may be useful for, or relevant to, the subject matter of an inquiry and any person so required shall be deemed to be legally bound to furnish such information within the meaning of section 176 and section 177 of the Indian Penal Code, 1860 (45 of 1860).

The Privacy Commission or any other officer, not below the rank of a Gazette Officer, specially authorized in this behalf by the Privacy Commission may enter any building or place where the Privacy Commission has reason to believe that any document relating to the subject matter of the inquiry may be found, and may seize any such document or take extracts or copies therefrom subject to the provisions of section 100 of the Code of Criminal Procedure, 1973 (2 of 1974), in so far as it may be applicable.

The Privacy Commission shall be deemed to be a civil court and when any offence as is described in section 175, section 178, section 179, section 180 or section 228 of the Indian Penal Code, 1860 (45 of 1860) is committed in the view or presence of the Privacy Commission, the Privacy Commission may, after recording the facts constituting the offence and the statement of the accused as provided for in the Code of Criminal Procedure, 1973 (2 of 1974), forward the case to a Magistrate having jurisdiction to try the same and the Magistrate to whom any such case is forwarded shall proceed to hear the complaint against the accused as if the case had been forwarded to him under section 346 of the Code of Criminal Procedure, 1973 (2 of 1974).

The decisions of the Privacy Commission shall be taken by majority and be binding and enforceable as a decree of a court as per the provisions of the Code of Civil Procedure, 1908.

In its decisions, the Privacy Commission has the power to:

1. require a competent organisation, company, person or other entity to take such steps as may be necessary to secure compliance with the provisions of this Act;
2. require a competent organisation, company, person or other entity to compensate any person for any loss or detriment suffered;
3. impose penalties.

The Privacy Commission shall be deemed to be a civil court for the purposes of section 195 and Chapter XXVI of the Code of Criminal Procedure, 1973 (2 of 1974), and every proceeding before the Privacy Commission shall be deemed to be a judicial proceeding within the meaning of section 193 and section 228 and for the purposes of section 196 of the Indian Penal Code, 1860 (45 of 1860).

Subject to any conditions prescribed by rules made in this regard by the Central Government, in consultation with the Attorney General of India and the Chief Justice of India, all appeals from Privacy Commission shall lie to a bench of the Supreme Court, specifically designated by the Chief Justice of India in that regard.

Every State Government shall, within a year of coming into force of this Act, by notification in the Official Gazette, with immediate effect, constitute a body to be known as the (name of the State) Privacy Commission to exercise the powers conferred on, and to perform the functions assigned to, it under this Act.

(2) Every State Privacy Commission shall consist of at least one Privacy Commissioner, to be appointed by the Governor of that State.

(3) Every State Government shall issue a public advertisement inviting applications to fill all vacancies in the State Privacy Commission.

(4) The selection committee for the appointment of the members of the State Privacy Commission shall be constituted by the Governor of that State and shall comprise of the—

(a) the Chief Justice and two senior most judges of the State High Court;

(b) the Law Minister of the State Government;

(c) the Leader of the Opposition or the Leader of the single largest opposition party with the greatest numerical strength in the Legislative Assembly of the State;

(d) one eminent person with experience in technology and academic or public interest research;

(e) representing the private sector; and

(f) one eminent person representing the civil society.

(5) All proceedings of the selection committee shall be matters of public record.

Explanation.—The term 'Civil Society' means non-Governmental and non-profit organisations that engage in the activities for the general upliftment and interests of the people in the field of privacy and is independent of Government funding, interference or influence.

(4) No Members of Parliament or Members of the Legislature of any State or Union territory having Legislative Assembly or a member of any political party shall be eligible for selection or appointment as a State Privacy Commissioner and persons holding any other office of profit or carrying on any business or practicing any profession, before he enters upon this office, may be selected or appointed as State Privacy Commissioner, as the case may be, if—

(a) he holds any office of trust or profit, resigns from such office; or

(b) he is carrying on any business, severs his connection with the conduct and management of such business; or

(c) he is practicing any profession, ceases to practice such profession.

(5) 'Except as provided for expressly under this Act, a State Privacy Commission shall have powers and functions coequal and identical to those of the Privacy Commission in all respects.

(6) A State Privacy Commission may appoint such officers and other employees, or engage any professional or expert, as it considers necessary for the efficient performance of its functions under this Act.

(7) Every State Privacy Commission shall be autonomous, independent, and free from external interference and shall be provided with sufficient operational resources including human, technical, and financial for the effective discharge of its duties and exercise of its powers.

(8) The financial power of Privacy Commission shall be subject to audit by the Comptroller and Auditor General of India.

(9) The salaries and allowances payable to and the other terms and conditions of service of State Privacy Commissioners shall be the same as that of the Chief Secretary to the State Government.

(10) The salaries and allowances payable to and the other terms and conditions of service of any officer, employee appointed or expert or professional engaged shall be such as may be prescribed by the State Privacy Commission.

Investigations or actions for enforcement may be instituted in the State Privacy Commission, suo motu or on complaints made by, any person, group of persons or anyone on their behalf, within the local limits of whose jurisdiction –

1. the complainant or data subject actually and voluntarily resides;
2. where the data controller or data processor is physically located or principally carries out business; or
3. the cause of action, wholly or in part, arises.

Any disputes as to jurisdiction shall be resolved in a manner that would accord the data subject the most timely and cost-effective access to redress, or promote the most timely and cost effective enforcement of the provisions of this Act.

Subject to any conditions prescribed by rules made in this regard by appropriate State Government, all appeals from a State Privacy Commission shall lie to a bench of the respective High Court, specifically designated by the Chief Justice in that regard.

Notwithstanding sub-section (1), appeals from a State Privacy Commission shall lie to the Privacy Commission where -

1. there is a dispute as to jurisdiction between two or more State Privacy Commissions; or
2. two or more State Privacy Commissions have passed orders or directions, or otherwise taken any action in respect of the same cause of action

Provided that in any such appeal, the Privacy Commission shall be included as a necessary party.

The State Government shall, in consultation with its Advocate General, the Chief Justice of its High Court and the Privacy Commission, prescribe rules governing the procedures to be followed:

(a) by and before the State Privacy Commission, and

(b) in respect of appeals to its High Court in terms of sub-section (1) of section 67.

Subject to the provisions of this Act, every State Government may, in consultation with the State Privacy Commission, by notification in the Official Gazette, prescribe rules in order to bring into effect any of the provisions of this Chapter of the Act.

The Central Government shall, by notification in the Official Gazette, constitute, within a period of six months from the enactment of this Act, a division in every High Court to be known as the Surveillance and Interception Review Division, hereinafter referred to as the Division:

Provided that if the Division is not constituted within the stipulated time period, no order for interception or surveillance issued after a period of ninety days from the date of the stipulated time period for constitution of the Division gets over, shall be valid and any interception or surveillance carried out under such an order shall be a violation of the provisions of this Act:

Provided further that if the Division is not constituted within the stipulated time period and till the time it is constituted, no existing order of surveillance or interception can be renewed.

(2) The Central Government shall appoint, for a period of two years or till the retirement of the Judge so appointed, whichever is earlier, two or more Judges of the High Court, as publicly designated by the Chief Justice of that High Court in consultation with the appropriate State Government, as the Division.

(3) The Central Government shall make available to the Division such information as may be necessary for the discharge of its functions under this Act.

(4) Subject to the provisions of this Act, one or more Public Advocates, shall be appointed by the Chief Justice of the High Court of that State, in consultation with the Office for Surveillance and Interception Reform of the Privacy Commission, the respective State Privacy Commission, the State Legal Services Authority, and the Bar Council of that State, for the purpose of defending the interests of the person being surveilled or intercepted, ensuring compliance with the provisions of this Act, and advancing legal arguments that further the protection of privacy and other fundamental rights under the Constitution:

Provided that while in appointing one or more Public Advocates, the Chief Justice of the High Court of the State shall do so after issuing public notice inviting applications of interest and a person shall be qualified to be appointed a Public Advocate to the Division if he—

(a) is a citizen of India, qualified to practice law with at least seven years' experience at the bar; and

(b) has experience with litigation on fundamental rights, criminal law and procedure, military and policing powers and oversight, and communications and information technology laws;

(5) The Public Advocate appointed, sub-section (4), shall—

(a) be provided copies of all ordinary applications made to and Government orders shared with the Division under this Act, including their supporting documents and filings;

(b) have a right to attend, be heard, and to file briefs and other filings before all proceedings of the Division; and

(c) be empowered to file appeals with respect to orders of the Division to the Supreme Court as provided for under this Act:

Provided that any decision not to file an appeal shall be made only after a legal opinion on the merits of the case and the decision for reasons recorded in writing which shall be made available along with the complete case files including all pleadings and materials when the disclosure of the orders of the Surveillance and Interception Review Division are made as per the provisions under the Act.

(6) All expenses incurred in connection with the Division shall be defrayed out of the Consolidated Fund of India.

(7) Subject to any rules made in this regard by the Central Government, in consultation with the Privacy Commission, the Division shall have power to regulate its own procedure in all matters arising out of the discharge of its functions including.

(8) The rules framed under sub-section (7), may provide for inner-camera proceedings of the Division, the manner in which third parties interested in the matter may make application for attending the hearings before the Division, for making the decisions of the Division public after a stipulated time period not exceeding one year since the date of the order and other incidental matters.

(9) The Division shall, for the purpose of making an inquiry under this Act, have the same powers as are vested in a Civil Court under the Code of Civil Procedure,1908 while trying a suit, in respect of the following matters, namely:—

(a) the summoning and enforcing the attendance of any witness and examining him on oath;

(b) the discovery and production of any document or other material object producible as evidence;

(c) the reception of evidence on affidavits;

(d) the requisitioning of any public record from any court or office;

(e) the issuing of any commission for the examination of witnesses.

(10) Any proceeding before the Division shall be deemed to be a judicial proceeding within the meaning of sections 193 and 228 of the Indian Penal Code, 1860 and the Division shall be deemed to be a civil court for the purposes of section 195 and Chapter XXVI of the Code.

(11) Subject to provisions of this Act, the Director General of Surveillance and Interception Reform constituted under the Privacy Commission, shall have access to the proceedings of the Division in order to assist the Division by providing expert evidence, legal arguments, and testimony.

Terms of service, removal and allied matters relating to persons appointed to the Tribunal shall be governed by rules made in this regard by the Central Government, in consultation with Privacy Commission and appropriate State Government.

Provided that no terms and conditions of service of persons appointed to the Tribunal shall be varied to their disadvantage after their appointment.

Subject to the provisions of Chapter IV of this Act, the Tribunal, which shall review, renew or take any other action with respect to orders of surveillance or interception, shall be the Tribunal within the local limits of whose jurisdiction –

1. the person to be surveilled or intercepted actually and voluntarily resides;
2. where the competent organization seeking to undertake surveillance or interception is physically located; or
3. where the actual act of interception or surveillance is to be carried out.

Subject to any conditions prescribed by rules made in this regard by the Central Government, in consultation with the Privacy Commission, and the appropriate State Governments, all appeals from any of the Tribunals shall lie to a bench of the Supreme Court, specifically designated by the Chief Justice of India in that regard

Whoever, except in conformity with the provisions of this Act, collects, receives, stores, processes, discloses or otherwise handles any personal data shall be liable to fine which may extend up to one hundred crore rupees based on the proportionality of the harm caused.

(2) Whoever commits the offence under sub-section (1) either intentionally, or with reckless disregard, he shall be liable for a term of imprisonment extending upto three years, and shall also be liable to fine:

Provided further that in case of companies, the penalty shall be governed by section 78.

(3) Whoever attempts to commit any offence under sub-section (1) shall be liable in the manner and to the extent provided for such offence under that sub-section.

(4) Whoever, except in conformity with the provisions of this Act, collects, receives, stores, processes, discloses or otherwise handles any sensitive personal data shall be liable to fine which may extend to two hundred crore rupees:

Provided that whoever commits the offence either intentionally, or with reckless disregard, he shall be liable for a term of imprisonment extending upto five years, and shall also be liable to fine:

Provided further that in case of offence committed by companies, the penalty shall be governed by section 78.

(5) Whoever attempts to commit any offence under sub-section (3) shall be punished with imprisonment and fine as provided for such offence in that section.

Whoever, except in conformity with the provisions of this Act, intercepts, or causes the interception of, any communication of another person shall be liable to a fine which may extend to one hundred crore rupees:

Provided that whoever commits the offence under sub-section (1) either intentionally, or with reckless disregard, shall be liable for a term of imprisonment extending up to three years, and shall also be liable to fine.

(2) Whoever attempts to commit any offence under sub- section (1) shall be punished with imprisonment and fine as provided in that sub-section.

Whoever, except in conformity with the provisions of this Act, orders or carries out, or causes the ordering or carrying out, of any surveillance of another person shall be liable to a fine which may extend to ten crore rupees:

Provided that whoever commits the offence defined above either intentionally, or with reckless disregard, shall be liable for a term of imprisonment extending upto five years, and shall also be liable to fine.

(2) Whoever attempts to commit any offence under sub- section (1) shall be punished with imprisonment and fine as provided in that section.

Whoever abets any offence punishable under this Act shall be punished with imprisonment or fine, as the case may be, provided for that offence.

Where an offence under this Act has been committed by a company, every person who, at the time of the offence was committed, was in charge of, and was responsible to, the company for the conduct of the business of the company, as well as the company shall be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly:

Provided that nothing contained in this sub-section shall render any such person liable to any punishment, if he proves that the offence was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence.

Notwithstanding anything contained in sub-section (1), where any offence under this Act has been committed by a company and it is proved that the offence has been committed with the consent or connivance of, or is attributable to any neglect on the part of any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall be deemed to be guilty of that offence, and shall be liable to be proceeded against and punished accordingly.

Notwithstanding anything contained in the Code of Criminal Procedure, 1973, the offences under this chapter shall be cognizable and non-bailable.

Whoever, in any case in which a penalty is not expressly provided by this Act, fails to comply with any notice or order issued under any provisions thereof, including an order of the Chief Privacy Commissioner or otherwise contravenes any of the provisions of this Act, shall be punishable with fine which may extend to one crore rupees, and, in the case of subsequent contravention, with an additional fine which may extend to ten lakh rupees for every day.

The award of punishment for an offence under this Act shall be without prejudice to any other action which has been or which may be taken under this Act with respect to such contravention.

The Central Government may, by notification in the Official Gazette, make rules to carry out the provisions of this Act until such time as the Privacy Commission is constituted.

(2) The Privacy Commission may, by notification in the Official Gazette, make rules to carry out the provisions of this Act:

Provided that where the Privacy Commission makes rules upon a subject already covered by the Central Government, it shall ensure that protections accorded to data subjects by its rules are maintained or improved.

(3) In particular, and without prejudice to the generality of the foregoing powers, such rules may provide for such measures as may be necessary to secure—

(a) all personal data related to data subjects located in India; and

(b) any personal data flowing into and out of, exported or imported out of India;

(c) the notification of theft, loss or damage under sub-section (4) of section 17;

(d) the notification of disclosure under sub-section (5) of section 19;

(e) the application by an intelligence organisation under sub-section (1) of section 31;

(f) the application to intercept a communication under sub-section (1) of section 28;

(g) the application to renew an interception of communication under sub-section (2) of section 33;

(h) the notification of an interception of communication under sub-section (1) of section 34;

(i) the application to not inform under sub-section (2) of section 34;

(j) the application to store information obtained as a result of any interception of communication under sub-section (2) of section 37;

(k) the application to carry out surveillance under sub-section (3) of section 39;

(l) notification to the general public under sub-section (2) of section 40; the application to renew surveillance under sub-section (2) of section 41;

(m) the notification of surveillance under sub-section (1) of section 42;

(n) the application to not inform under sub-section (2) of section 42;

(o) the application to store information obtained as a result of surveillance under sub-section (2) of section 45;

(p) salaries, allowances and other terms and conditions of service of the Chief Privacy Commissioner, Privacy Commissioners, Secretaries and other members, staff and employees of the Privacy Commission;

(q) procedure to be followed by the Privacy Commission;

(r) powers and duties of Secretaries, officers and other employees of the Privacy Commission; and

(s) the effective implementation of this Act.

(4) Every rule made under this Act shall be laid, as soon as may be after it is made, before each House of Parliament while it is in session for a period of thirty days which may be comprised in one session or in two successive sessions and if before the expiry of the session in which it is so laid or the session immediately following, both Houses agree in making any modification in the rule, or both Houses agree that the rule should not be made, the rule shall thereafter have effect only in such modified form or be of no effect, as the case may be, so however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule.

(5) Every rule made by the Central Government under sub-section (1) shall require express assent of both Houses of Parliament:

Provided that where assent under sub-section (5) is not obtained, the rules shall not be valid.

On and from the appointed day, courts or authorities shall have, or be entitled to exercise jurisdiction with respect to remedies provided for data subjects and against data subjects under this Act with respect:

Provided that legal proceedings for relief in the nature of interim injunctions or mandatory injunctions shall not be initiated against the authorities provided for under this Act including but not limited to the State Privacy Commission and the Privacy Commission:

Provided that further provisions of the Arbitration and Conciliation Act, 1996 shall not bar the Privacy Commission or the State Privacy Commission or any other body from exercising jurisdiction under the provisions of this Act.

(2) No order passed under this Act shall be appealable except as provided therein and no injunction shall be granted by any court or Division to any authority established under this Act in respect of any action taken or to be taken in pursuance of any power conferred by or under this Act.

No suit or other legal proceeding shall lie against the Central Government, State Government, Privacy Commission, Chief Privacy Commissioner, Privacy Commissioner or any person acting under the direction either of the Central Government, State Government, Privacy Commission, Chief Privacy Commissioner or Privacy Commissioner in respect of anything which is in good faith done or intended to be done in pursuance of this Act or of any rules or any order made thereunder.

Notwithstanding anything inconsistent therewith contained in any other law for the time being in force any communication or complaint made in good faith made by any person alleging violation of the provisions of this act, if made to the Privacy Commission, the Surveillance and Interception Review Divisions and their Public Advocates, or to any High Court or the Supreme Court, shall not be treated as a violation of this Act or any other law.

If difficulty arises in giving effect to the provisions of this Act as provided for under this section, the Central Government may, by order, published in the Official Gazette, make such provisions, not inconsistent with the provisions of this Act, as appears to it to be necessary or expedient for removing the difficulty:

Provided that no such order shall be made under this section after the expiry of a period of three years from the commencement of this Act.

The provisions of sub-section (1) shall only apply in instances when it is with respect to conflict between this Act and any existing law;

Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament.

Except as otherwise provided in this Act, the provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force, including provisions in—

(a) sections 43A, 69, 69B, 72 and 72A of the Information Technology Act, 2000;

and

(b) sections 7, 28, 29, 30, 31, 32, 33 and 47 of the Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016; and

(c) section 5(2) of the Indian Telegraph Act, 1885; and

(d) section 21 of the Prevention of Money Laundering Act, 2002; and The Census Act, 1948.

(2) Nothing contained in sub-section (1) shall apply to the provisions of the Representation of the People Act, 1951 and the Right to Information Act, 2005.

(3) Where the provisions of any law in force provide for additional safeguards that are not inconsistent with the present Act, those provisions shall continue to apply and the Act shall not be considered in derogation of such provisions.