Introduction
The Digital Personal Data Protection (DPDP) Act, 2023 establishes India’s statutory framework for processing digital personal data while seeking to balance individual privacy, data protection and legitimate data use.
Key Legal Provisions
- Scope of the Act: The Act regulates the processing of digital personal data in India and also applies to processing outside India when it relates to offering goods or services to individuals in India.
- Consent-based processing: Personal data must generally be processed on the basis of consent or specified legitimate uses. Consent must be free, specific, informed and unambiguous, and individuals should be able to withdraw it.
- Notice requirement: A Data Fiduciary must provide notice explaining what personal data is being collected and the purpose for which it will be processed.
- Rights of Data Principals: Individuals, termed Data Principals, receive rights relating to their personal data, including the right to access information, correction and erasure, grievance redressal and nomination.
- Duties of Data Principals: Individuals are also required to provide authentic information, comply with applicable laws and avoid impersonation or suppression of material information while exercising their rights.
- Obligations of Data Fiduciaries: Entities determining the purpose and means of processing data must ensure accuracy, security, lawful processing and appropriate safeguards for personal data.
- Data security: Data Fiduciaries must take reasonable security safeguards to prevent personal-data breaches and must notify the prescribed authority and affected individuals in cases of significant breaches.
- Children’s data: Processing the personal data of children requires verifiable parental consent, while practices such as tracking, behavioural monitoring and targeted advertising directed at children are restricted under the Act.
- Significant Data Fiduciaries: The government may designate certain entities as Significant Data Fiduciaries based on factors such as the volume and sensitivity of data and their potential impact on India’s sovereignty, integrity or security. Such entities face enhanced compliance obligations.
- Data Protection Board of India: The Act provides for a Data Protection Board of India as the regulatory and adjudicatory mechanism for enforcing compliance and dealing with personal-data breaches and violations.
Conclusion
The DPDP Act, 2023 marks an important shift from fragmented data-protection provisions towards a dedicated statutory framework for digital personal data. Its success will depend on effective enforcement, institutional independence, transparency and proportionality, ensuring that India’s digital transformation remains both innovation-friendly and rights-respecting.
| This Concept Has Been Elaborately Discussed Under This Article: Facial Recognition and Democratic Freedoms: Balancing Security, Privacy and the Right to Protest |