Author: Keshav Garg, Christ University
To the Point
The digital revolution has surged in India – e Commerce and fintech, social media and AI, and digital governance – and the momentum has been accelerating. The transformation has led to the accumulation and manipulation of vast amounts of personal information, which has sparked concerns with privacy, surveillance, and cybersecurity. In response to these concerns, the Parliament has passed the Digital Personal Data Protection Act, 2023 (DPDP Act) which is India’s first comprehensive law relating to the processing of digital personal data.
The Act provides a legal basis for lawful data processing, enhances individuals’ privacy rights, and sets requirements for compliance for Data Fiduciaries. It also includes heavy punishment for non-compliance and strikes a balance between innovation and economic growth.
Use of Legal Jargon
The DPDP Act includes several concepts of law that state the rights and responsibilities of the stakeholders:
Data Principal – Person to whom personal data refers to.
Data Fiduciary – anyone or entity who decides on the purposes and the means of the processing of personal data.
Data Processor – An organization that processes personal data for the Data Fiduciary.
Consent – Free, specific, informed, unconditional and unambiguous indication by which the data Principal indicates his consent.
.
Personal Data Breach – Processing of personal data without authorization, disclosure of personal data, acquisition, alteration, destruction or loss of personal data.
Data Protection Board of India – Statutory body to ensure enforcement of the Act and penalties.
Cross-Border Data Transfer – Transfer of personal data to outside India (restricted by Government Notification).
Data Minimisation – Processing only the data required for a particular purpose.
Purpose Limitation – Personal data shall be processed for the purpose for which consent is given.
The Proof
Introduction
The courts in India now recognized privacy as a fundamental right, thus altering the constitutional landscape in the country. Personal data is an enormously valuable economic asset as data becomes increasingly digitised in the public and private sectors. But as cybercrime, identity theft, unauthorized data sharing, and the misuse of AI become increasingly prevalent, individuals are facing unprecedented privacy risks.
The DPDP Act, 2023 aims to address the issue of digital personal data processing and hold organizations responsible for personal data.
Objectives of the Act
The Act aims to:
Secure digital personal information of individuals.
Understand privacy as an important legal right.
Promote responsible innovation.
Set accountability for data processors.
Move India towards a digital economy.
Strengthen cybersecurity governance.
Rights of Data Principals
The Act provides a number of rights, such as:
1.The right to access information.
Individuals can request information regarding:
● Categories of personal data processed.
● Processing purposes.
● Entities with whom data has been shared.
2. Right to Correction
There may be some people who need inaccurate or incomplete data that need to be corrected.
3. Right to Erasure
Personal information may be deleted when there is no longer a need for it as long as there is no legal obligation to keep it.
4. Right to Grievance Redressal
All Data Fiduciaries need to develop a suitable grievance redressal mechanism.
5. Right to Nominate
Individuals may nominate another person to exercise their rights in case of death or incapacity.
The obligations of Data Fiduciaries
Data Fiduciaries must:
● Process data lawfully.
● Obtain valid consent.
● Ensure reasonable security safeguards.
● Report data breaches promptly.
● Delete unnecessary personal data.
● Maintain transparency.
● Protect children’s data.
● Avoid behavioural monitoring of children.
Significant Data Fiduciaries
Certain organizations handling large volumes of sensitive personal information may be designated as Significant Data Fiduciaries.
Their additional obligations include:
● Appointment of a Data Protection Officer.
● Appointment of an Independent Data Auditor.
● Conducting Data Protection Impact Assessments.
● Periodic compliance audits.
● Risk management measures.
Penalties
The DPDP Act has one of the most stringent penalties regimes in India.
The non-compliance can be penalized up to ₹250 crore depending on the nature and extent of the non-compliance, such as:
1.Failure to prevent data breaches.
2. Failure to notify authorities.
3. Failure to protect children’s data.
4. Failure to comply with Board directions.
Cross-Border Data Transfer
The DPDP Act does not require data localization like previous proposals, but allows cross-border transfers, subject to exceptions by the Central Government.
This gives international business a bit of flexibility and strategic limitations when needed for national security.
Challenges
Despite its significance, several concerns remain:
● Broad exemptions granted to government agencies.
● Limited judicial oversight.
● Absence of detailed algorithmic accountability.
● Lack of explicit data localisation requirements.
● Ambiguity regarding implementation timelines.
● Compliance burden on small businesses.
Abstract
The Digital Personal Data Protection Act, 2023 is a ground-breaking advancement in Indian privacy law. It creates an extensive set of rules on the processing of digital personal data, whether by public or private sector actors. The law strikes a balance between the rights to privacy protected by the constitution and the needs for governance and commercial innovation. The Act aims to establish a trustworthy digital environment through consent-based processing, statutory rights for the individuals, regulatory mechanisms provided by the Data Protection Board and severe financial penalties. But operationality, policy and institutional autonomy are still key factors to its long-term viability.
Case Laws
1. Justice K.S. Puttaswamy (Retd.) vs. Union of India, (2017)
The Supreme Court held a unanimous decision, regarding the Right to Privacy as a Fundamental Right under Article 21 of the Constitution. This judgment helped to establish a constitutional framework for data protection in India.
Significance:
● Privacy is recognized as a fundamental right.
● Established proportionality doctrine.
● Influenced the DPDP Act.
2. Justice K.S. Puttaswamy (Aadhaar-5J.) v. Union of India (2018)
While affirming the constitutional soundness of the Aadhaar scheme, the Supreme Court also highlighted the provisions of proportionality and data protection.
Significance:
1. Limited validation of Aadhaar.
2. Reaffirmed the importance of safeguarding personal data.
3. Lent inspiration to future privacy law.
3. Anuradha Bhasin v. Union of India (2020)
Although concerning internet shutdowns, the Court reaffirmed that constitutional rights continue to apply in the digital environment.
Significance:
● Reinforced digital constitutionalism.
● Highlighted accountability in digital govern
4. Shreya Singhal vs Union of India (2015)
The Supreme Court has ruled in favor of free speech online by declaring Section 66A of the Information Technology Act unconstitutional.
Significance:
1. Strengthened digital rights.
2. Strengthened constitutional safeguards on the internet.
Conclusion
Digital Personal Data Protection Act, 2023 is another major milestone in the ever-changing digital governance structure in India. The law acknowledges the significance of consent, accountability, transparency and security, aiming to create a “balanced ecosystem” which enables technology to flourish alongside personal rights. The Act is based on the Constitutional principles set in India by the Supreme Court and also brings India in sync with global privacy standards. However, the successful implementation requires proper rule-making, independence of the rules, good enforcement of the Data Protection Board, compliance of the companies and awareness of the public. India’s privacy laws need to be flexible to meet technological challenges as AI, cloud computing, and cross-border data transfer continue to grow. If enforced effectively, the DPDP Act could establish the foundation for India’s digital economy, ensuring it is transparent, proportionate, and safeguards the rights of all parties involved.
FAQ
Q1. What is the Digital Personal Data Protection Act, 2023?
It is India’s main law governing the collection, processing, storage and protection of digital personal data.
Q2. Who is a Data Principal?
The Data Principal is the person(s) whose personal data is being processed.
Q3. What is a Data Fiduciary?
A Data Fiduciary is any individual or entity, who determines the purposes and means of processing of personal data.
Q4. What are the key powers in the Act?
Access, correction, deletion, grievance redress and designating another person to act on behalf of the individual.
Q5. What’s the highest possible fine for the Act?
Depending on the violation, penalties can be as much as ₹250 crore.
Q6. Is it possible to transfer personal data internationally under the Act?
Yes. In general, cross-border transfer is allowed, but may be prohibited by the Central Government.
Q7. Why is the DPDP Act important?
It safeguards the privacy of the citizens, improves the accountability of companies, boosts cybersecurity, and builds trust in India’s digital economy.
