The Digital Personal Data Protection (DPDP) Act 2023

DRASInt® Risk Alliance
Aug 15, 2023
6 min read

Updated: Apr 19

In today's digital age, the proliferation of technology has led to an exponential increase in the collection, processing, and sharing of personal data.

To address the concerns surrounding data privacy and security, governments around the world are enacting legislation to safeguard individuals' personal information. India, too, has taken a significant step in this direction with the introduction of the Digital Personal Data Protection (DPDP) Act 2023.

Key Provisions of the Act

The act applies to both government and private entities that process personal data. This encompasses entities operating within India as well as those outside the country that handle the data of Indian citizens. It provides comprehensive definitions for various terms like "personal data," "sensitive personal data," "data fiduciary," and "data processor," ensuring a clear understanding of the roles and responsibilities of different stakeholders.
One of the pivotal features of the act is the establishment of the Data Protection Authority (DPA). The DPA is entrusted with the duty of supervising and regulating the data protection ecosystem in India. It holds the authority to investigate and issue orders in cases of violations. The DPA's role is not just punitive; it also plays a crucial educational role by promoting awareness and compliance with the act's provisions.
The act introduces stringent standards for obtaining consent from individuals for data processing activities. Data fiduciaries must inform individuals about the purpose for which their data is being collected and processed. Any subsequent changes to the purpose require renewed consent. This emphasizes the importance of transparency and informed decision-making by data subjects.
The act upholds individuals' rights over their personal data. It enshrines the rights to access, correct, erase, and port their data. This puts individuals in control of their information, allowing them to manage their online presence more effectively. Additionally, individuals can object to certain types of data processing, ensuring a higher degree of autonomy.
Recognizing the need for enhanced protection, the act classifies certain categories of data as sensitive personal data. This includes data related to health, biometrics, financial information, etc. Processing such data requires explicit consent and compliance with stricter regulations to ensure its security and privacy.
While the act permits cross-border transfer of data, it mandates that such transfers must adhere to specific conditions outlined by the DPA. The aim is to ensure that personal data is protected even when it moves beyond national borders and to prevent data being sent to jurisdictions with inadequate data protection laws.
The act imposes obligations on high-risk data fiduciaries to conduct data protection impact assessments (DPIAs). These assessments help identify and mitigate risks associated with data processing, ultimately contributing to the overall privacy and security of individuals' data.
Data fiduciaries are required to implement measures to ensure accountability for their data processing activities. This involves maintaining transparency about data practices and establishing mechanisms to address any breaches. The act also acknowledges the importance of non-identifiable data while imposing limitations to prevent re-identification and unauthorized use.
To enforce compliance, the act establishes penalties for violations. These penalties can be substantial, making it imperative for entities to adhere to the provisions. Additionally, individuals affected by data breaches are granted the right to seek compensation, enhancing their ability to address any harm suffered.
The act recognizes the significance of research and innovation while respecting data privacy. It offers provisions that allow for the utilization of personal data for research purposes, ensuring that innovation isn't stifled while safeguarding individuals' rights.
Certain categories of data processing are exempted from some provisions of the act. For instance, data processing for journalistic purposes or national security may be subject to specific guidelines that balance data protection with the public interest.
To facilitate compliance, the act encourages the development of codes of practice and codes of conduct by industry bodies. These guidelines provide practical directions for data fiduciaries to ensure that their practices align with the law's requirements.

The DPDP Act 2023 marks a significant milestone in India's efforts to address the challenges of data privacy and security in the digital era. By establishing a comprehensive framework for data protection, the act seeks to balance individuals' rights with the needs of businesses and innovation. With its stringent provisions, rights-based approach, and focus on accountability, the act aims to create a safer and more transparent digital ecosystem in India. As technology continues to evolve, the act's effectiveness will depend on its enforcement and adaptation to emerging challenges in the data landscape.

Differences between DPDP Act 2023 (DPDP Act) and the Information Technology (IT) Act

It is to be noted that, the DPDP Act 2023 and the Information Technology (IT) Act of India are two distinct pieces of legislation, each addressing different aspects of the digital ecosystem. Here's a comparison of how they differ :-

Focus and Purpose- The primary focus of the DPDP Act is the protection of individuals' personal data. It provides a comprehensive framework to regulate the collection, processing, storage, and transfer of personal data to ensure the privacy and security of individuals' information. The IT Act, on the other hand, addresses a broader range of issues related to electronic governance, digital signatures, cybercrime, and online communication. It covers aspects such as digital signatures, electronic records, and offenses related to cybercrime.
Scope- The DPDP Act primarily deals with the protection of personal data and data privacy. It applies to both government and private entities involved in data processing activities, irrespective of the medium (digital or non-digital). IT Act covers a wider range of topics, including electronic transactions, digital signatures, data protection, and cybercrime. It was enacted to provide legal recognition to electronic transactions and facilitate electronic governance.
Personal Data Protection- The DPDP Act specifically focuses on regulating the processing of personal data, including sensitive personal data. It outlines principles for data processing, consent mechanisms, data subject rights, and the establishment of a Data Protection Authority. The IT Act includes provisions related to data protection, but it is not as comprehensive as the DPDP Act in terms of addressing the nuances of personal data protection. The IT Act primarily addresses cybersecurity, hacking, and unauthorized access.
Data Processing Principles- The DPDP Act emphasizes principles like informed consent, purpose limitation, data minimization, transparency, and accountability for data fiduciaries. The IT Act does not extensively cover these data processing principles. Its focus is more on legal recognition of electronic records and digital signatures.
Regulatory Authority- The DPDP Act establishes a dedicated DPA responsible for enforcing data protection regulations, investigating violations, and ensuring compliance. The IT Act doesn't specifically establish an authority solely dedicated to data protection. It mainly addresses issues related to electronic transactions and cybersecurity.
Penalties and Enforcement- The DPDP Act outlines significant penalties for non-compliance with data protection regulations, including fines for data breaches and violations of data subjects' rights. The IT Act includes provisions for penalties related to cybercrimes and unauthorized access, but it doesn't impose penalties for data protection violations to the same extent as the DPDP Act.
Sectoral Approach- The DPDP Act adopts a holistic approach, covering personal data processing across various sectors and industries. The IT Act has a broader scope, including provisions for electronic signatures, digital certificates, and regulating e-commerce transactions.
While both the DPDP Act 2023 and the Information Technology Act address aspects of the digital realm, they serve different purposes. The DPDP Act focuses specifically on safeguarding individuals' personal data and enhancing data privacy, whereas the IT Act has a broader scope encompassing electronic transactions, digital signatures, and cybersecurity. The DPDP Act thus fills the gap in comprehensive data protection regulation that was not adequately covered by the IT Act. These two acts would work in tandem, with the DPDP Act specifically dealing with personal data protection while the IT Act addresses broader electronic governance and cybersecurity issues.

Striking a Balance for Data Privacy

The DPDP Act 2023 holds promise for safeguarding digital #privacy, yet key concerns need attention. While #penalties are proposed for violations, enforcing them cross-border poses challenges, demanding #global cooperation. Ambiguous terms like 'personal data' must be clarified for consistent understanding. Cross-border data transfer is positive, but #safeguarding data in foreign jurisdictions is a worry, requiring alignment with international standards.
Balancing consent in complex data ecosystems is tricky; innovative consent management and guidelines can help. Government data processing for surveillance needs careful #balance between privacy and national security. Detailed provisions may burden small businesses; harmonizing protection and growth is crucial.
Balancing innovation and stringent regulation is vital; a flexible framework maintaining data protection and fostering tech advancements is needed. Evolving technologies require regular updates, collaboration, and legal-technical synergy. Data localization mandates can conflict with global operations; equilibrium is vital.
Harmonizing the DPDP Act with existing/future laws prevents confusion. Public awareness is key; education #campaigns aid understanding of data rights. Supporting smaller businesses with technical measures ensures equitable protection.
DPDP Act 2023 enhances privacy, but challenges exist. #collaboration among stakeholders is crucial for lasting relevance. Striking the right balance is imperative for data protection, innovation, and economic growth. Continuous review ensures effectiveness in the evolving digital landscape.