What is the Digital Personal Data Protection (DPDP) Act, 2023 all about?

There was no specific law for Data protection in India. The Information Technology Act of 2000 and its relevant rules and regulations were used to regulate the information of an individual. To protect an individual’s identity and data, the fifth iteration of the proposed personal data protection legislation bill released by the Ministry of Electronics and Information Technology on 18^th November 2022 named Digital Personal Data Protection Bill, 2022 was made available for public consultations. The Bill was passed in both Houses of Parliament and also received the President of India’s assent and came to be known as The Digital Personal Data Protection Act, 2023 (“DPDP Act 2023”). It was published in the official gazette on 11^th August 2023. 

The DPDP Act focuses on digital personal data and does not apply to non-personal data. It aims to recognize the rights of individuals pertaining to the protection of their data in digital form or in non-digital form which is subsequently digitized and usage of such personal data of individuals by any other person for lawful purposes.

Once provisions of the DPDP Act are brought into force, the DPDP Act will replace Section 43A of the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data of Information) Rules, 2011 (“SPDI Rules”).

The Highlights of the DPDP Act, 2023

1. It only applies to personal data, whether collected in digital form or non-digital data which is digitized subsequently.
2. It applies to digital personal data that is processed outside India, only if such processing is in connection with any activity related to the offering of goods and services to data subjects in India.
3. It does not apply to personal data that is processed by an individual for any personal or domestic purpose or made publicly available by the data subject themselves or any other person under a legal obligation.

1. The personal data should only be processed for a lawful purpose provided the consent is made available from the data subject in accordance with the Act.
2. Only such personal data should be collected, which is necessary.

1. The DPDP Act’s regulations apply to all types of personal data and do not include sub-categories of personal data, such as sensitive personal data or critical personal data. As a result, regardless of the nature or kind of personal data, the obligations of the DPDP Act will apply equally to all forms of personal data. This approach departs from current Indian data protection law, as embodied in the SPDI Rules, which distinguishes between ‘personal information’ and ‘sensitive personal data or information’ and prescribes incremental compliance requirements for the processing of sensitive personal data or information.

1. The underlying basis for processing personal data is consent, which must be free, precise, informed, unconditional, and unequivocal. Such consent must be supplied in the form of clear affirmative action and must represent the data principal’s agreement to handle her personal data for the defined purpose.
2. The data subject has the right to withdraw consent at any moment with the same ease with which she obtained it. The withdrawal of consent has no effect on the legality of the processing of personal data based on consent prior to its withdrawal.
3. Along with or preceding each request for consent, a notice must be provided to the data principal informing her about the personal data, the proposed purpose of processing, and the manner in which she may exercise her rights to withdraw consent, use the grievance redressal mechanism, and file a complaint with the DPB (defined below). Where the data principal has consented to the processing of her personal data prior to the law’s implementation, a similar notice must be provided to her as soon as reasonably practicable, and the data fiduciary may continue processing the data principal’s data until they withdraw the prevalent consent in response to the aforementioned notice.
4. The data subject shall be able to access the notice and consent form in English or any other language specified under the Constitution of India’s Eighth Schedule (which includes Urdu, Tamil, Telugu, Sanskrit, Punjabi, Marathi, Hindi, Kannada, Bengali, Gujarati, Kashmiri, and so on).
5. The DPDP Act has rechristened the idea of ‘deemed consent’, which was anticipated in the draft bill presented in 2022 for processing of personal data for certain special use situations without the approval of the data principal and now called its ‘legitimate uses’. Specific purposes for which the data principal has voluntarily shared personal information without objecting to such processing, processing for purposes of employment, responding to medical emergencies, performing any function under law or the State providing any service or benefit to the data principal, and compliance with any judgment or order issued under any law, etc.

1. Data fiduciaries are accountable for DPDP Act compliance, including personal data processing performed on their behalf by a data processor. When data fiduciaries process personal data that is likely to be used to make a decision that affects the data principle or that is to be shared with another data fiduciary, they must verify the accuracy and completeness of such personal data. Personal data must also be deleted if the data principal withdraws her consent or if it is reasonable to presume that the indicated purpose is no longer being served unless such retention is required for legal compliance.

1. Personal data breaches must be reported to the DPB (described below) and each impacted data principal in accordance with the prescribed procedures.

1. Personal data can be transmitted to any other country or territory for processing by a data fiduciary unless the Central Government prohibits such transfers to any notified countries. In other words, the DPDP Act has a blacklisting method, implying that personal data is freely transferable unless it is proposed to be transferred to a region or country that has been ‘blacklisted’ by the Central Government. However, the DPDP Act specifies that if any other law or sectoral regulation provides for a higher level of protection for, or restricts, the transfer of personal data outside India, whether in relation to specific personal data or a class of data fiduciaries, such law or regulation will apply.

1. The Central Government may designate any or a subset of data fiduciaries as important data fiduciaries based on a variety of characteristics (such as the volume and sensitivity of personal data processed, the risk to the data principal’s rights, state security, and so on). Significant data fiduciaries must meet additional requirements such as appointing an individual as a data protection officer based in India, appointing an independent data auditor to evaluate compliance with the DPDP Act, conducting periodic audits and data protection impact assessments, and implementing other measures such as periodic data protection impact assessments.

1. Processing personal data of minors and people with disabilities requires the verifiable agreement of a parent or legal guardian. The DPDP Act forbids tracking or behavioral monitoring of children, as well as targeted advertising intended at children, and the processing of children’s data that is likely to have a negative impact on a child’s well-being. Notably, the DPDP Act allows the Central Government to exempt some groups of data fiduciaries and processing for specific purposes from the necessity of seeking parental agreement and barring behavioral surveillance. It also allows the Central Government to exempt data fiduciaries from processing data of children over a certain age but under the age of 18 in certain circumstances, without the specific requirements associated with processing children’s data.

1. The DPDP Act grants data subjects certain rights, including the right to access information about personal data, including a summary of personal data being processed, the underlying processing activities, and any other information as prescribed, as well as the identities of all data fiduciaries and data subjects with whom such data was shared; the right to correct and erase personal data; and the right to appoint someone to exercise rights on their behalf in the event of their death. According to the DPDP Act, data fiduciaries must provide data subjects with easily accessible grievance redressal options. In this regard, before contacting the DPB (described below), the data principal must exhaust all other avenues for grievance redressal.

1. The DPDP Act regulates the establishment of a Data Protection Board (“DPB”) as an enforcement body, with the authority, among other things, to direct any urgent remedial or mitigation measures upon receipt of notification of a personal data breach, inquire into such breach, impose penalties for non-compliance, inspect any document, summon, and enforce the attendance of any person, and so on. Within defined periods and in the authorized manner, an appeal against a DPB ruling may be filed with the Telecom Disputes Settlement and Appellate Tribunal (“TDSAT”) created under the Telecom Regulatory Authority of India Act, 1997. An appeal against the TDSAT order may be filed with the Supreme Court of India.

1. The DPDP Act gives the Central Government the authority to request information from the DPB, the data fiduciary, or any other intermediary. If the Central Government receives a reference from the DPB indicating that it has imposed monetary penalties on a data fiduciary in two or more instances and advises blocking public access to any information transmitted on any computer resource, it may, by written order, direct blocking public access to such information on the grounds of public interest. This order must be issued in writing and after the data the fiduciary has been given an opportunity to be heard.

1. Depending on the severity of the violation, the DPB may levy monetary penalties of up to INR 250 crores at the conclusion of an investigation. Several elements may be considered to establish the magnitude of penalties, including the kind, gravity, and duration of the breach, the type of personal data impacted, the recurring nature of the breach, and whether the defaulting person realized a gain or averted any loss as a result of the breach, among others.
2. The DPDP Act makes no provision for compensating data subjects whose personal information has been compromised. This is a shift from the IT Act, which allows harmed data subjects to seek restitution from a data fiduciary who failed to adopt reasonable security safeguards, resulting in unlawful loss or gain. However, the DPDP Act imposes certain obligations on data subjects, such as providing only verifiably authentic information, not impersonating another person while providing personal data for a specific purpose, not filing a false or frivolous grievance or complaint with a data fiduciary or the DPB, and so on. The data subjects may be fined up to INR 10,000 for any infringement of such duties.

The DPDP Act also allows the DPB to accept a voluntary undertaking from a person facing action for noncompliance with the law, which may include a commitment to:

1. act within a time frame determined by the DPB,
2. refrain from taking specified action, and/or
3. publicize the voluntary undertaking.

Once such a voluntary undertaking is recognized by the DPB, it constitutes a bar to legal proceedings relating to the substance of the voluntary undertaking.

The DPDP Act exempts from the application:

1. all of its provisions in the case of processing by certain notified instrumentalities of the State in the interests of India’s sovereignty and integrity, public order maintenance, and so on, and
2. some of its provisions in the case of processing for the enforcement of a legal right or claim, merger or amalgamation, investigation, or prosecution of an offense, and so on.

The DPDP Act also allows the Central Government to exclude certain data fiduciaries, including startups, from specific obligations such as notice and retention requirements, those applicable to substantial data fiduciaries, and so on by notification.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To read more about the Act, please click here.