The Rajya Sabha on December 09, 2025, issued the Digital Personal Data Protection (Amendment) Bill, 2025, further to amend the Digital Personal Data Protection Act, 2023.
The following has been amended, namely: -
• The Amendment Bill substantially expands the definition of “harm” to include mental injury, profiling, surveillance, discrimination, financial and reputational loss, and psychological manipulation, thereby strengthening the basis for remedies.
• It introduces a statutory right to compensation for Data Principals, empowering the Data Protection Board to adjudicate and award damages for violations.
• The Bill mandates specific, explicit, and separate consent for sharing personal data, including cross-border transfers, and treats unauthorized data sharing as a personal data breach.
• It strengthens user rights by introducing the Right to be Forgotten against State authorities and the right to data portability for automated processing.
• Institutional independence is reinforced by restructuring the Data Protection Board’s appointment process, removing excessive government control, and subjecting exemptions to judicial review, while tightening restrictions on profiling, behavioural monitoring, and targeted advertising without consent.
[Bill No. XXXVIII of 2025]
