The Digital Personal Data Protection Act of 2023 in India

The Digital Personal Data Protection Act of 2023 has been enacted in India, following approval from both houses of Parliament and the President’s assent. This legislation aims to strengthen data protection and accountability for entities operating in India, such as internet companies, mobile apps, and businesses handling citizens’ data. It aligns with global data protection standards, drawing inspiration from models like the EU’s GDPR and China’s PIPL.

The DPDP Act establishes a higher level of accountability and responsibility for entities operating in India. It prioritizes the privacy and data protection rights of Indian citizens emphasizing the “Right to Privacy.” The Act applies to the processing of digital personal data in India, regardless of whether the data was originally collected digitally or not. It also extends its scope to cover data processing activities abroad, specifically targeting organizations offering goods or services to Indian individuals or engaging in the profiling of Indian citizens.

The DPDP Act underwent significant amendments since its initial introduction in 2019, resulting in a comprehensive overhaul. It focuses on regulating the collection, storage, processing, and transfer of personal data in the digital landscape. The Act introduces several key provisions, including definitions of terms such as data fiduciary, data processor, data principal, and consent manager.

The Act also emphasizes individual consent to use data and grants data principal rights, including the right to information, correction and erasure, grievance redressal, and the right to nominate someone in the event of death or incapacity. It establishes additional obligations for significant data fiduciaries based on the quantity and sensitivity of the data they handle, requiring them to appoint a Data Protection Officer (DPO) to address data principal inquiries and concerns.

The enactment of the DPDP Act signifies an important milestone in India’s technology landscape, as it strengthens data protection measures and aligns the country with global data protection standards.

Sources:
– Digital Personal Data Protection Act of 2023 (official Gazette notification the Government of India)
– Union Cabinet approval, Lok Sabha approval, Rajya Sabha approval