Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

Introduction

The Digital Personal Data Protection Act, 2023 (DPDPA) marks a significant milestone in India's journey towards safeguarding individual privacy in the digital age. Enacted in response to the Supreme Court's landmark judgment in the Puttaswamy case (2017), which recognized privacy as a fundamental right, the Act aims to balance the rights of individuals with the need for innovation and economic growth in the digital ecosystem.

Key Context of the Digital Personal Data Protection Act, 2023

• Judicial Mandate: The Act stems from the Supreme Court's directive in the Puttaswamy judgment, which emphasized the need for a robust data protection framework.
• Global Trends: Aligns India with global data protection regimes like the EU's GDPR, addressing cross-border data flows and privacy concerns.
• Digital Economy Growth: With India’s digital economy projected to reach $1 trillion by 2025, the Act seeks to ensure trust and accountability in data handling.
• Rising Cyber Threats: Increasing instances of data breaches and misuse necessitated a comprehensive legal framework.
• Policy Evolution: The Act follows earlier drafts, including the 2018 Justice Srikrishna Committee report and the Personal Data Protection Bill, 2019, reflecting years of stakeholder consultations.

Value Addition Block — Key Milestones in India's Data Protection Journey

Salient Features of the Digital Personal Data Protection Act, 2023

1. Applicability and Scope

• Covers digital personal data processed within India and data of Indian citizens processed abroad.
• Excludes non-personal data and offline data processing.

2. Key Principles

• Purpose Limitation: Data to be collected only for specified purposes.
• Data Minimization: Only necessary data to be collected.
• Storage Limitation: Data to be retained only for the required duration.

3. Rights of Data Principals (Individuals)

• Right to Information: Access to details on data processing.
• Right to Correction and Erasure: Rectification or deletion of inaccurate data.
• Right to Grievance Redressal: Mechanism to address complaints.

4. Obligations of Data Fiduciaries (Entities Handling Data)

• Consent-Based Processing: Explicit and informed consent required.
• Data Protection Impact Assessments: For high-risk processing activities.
• Accountability: Fiduciaries must ensure compliance with the Act.

5. Cross-Border Data Transfers

• Allows data transfer to countries notified by the government, ensuring adequate safeguards.

6. Data Protection Board of India (DPBI)

• An independent body to oversee compliance, resolve disputes, and impose penalties.

7. Penalties for Non-Compliance

• Stringent penalties up to ₹250 crore for violations, ensuring deterrence.

8. Exemptions

• Government Exemptions: For national security, public order, and research purposes.
• Startups and Small Entities: Relaxed compliance norms for ease of doing business.

Way Forward

• Capacity Building: Training stakeholders, including startups and small businesses, to ensure compliance.
• Global Harmonization: Aligning with international standards to facilitate cross-border trade.
• Strengthening DPBI: Ensuring independence and adequate resources for effective enforcement.
• Public Awareness: Educating citizens about their rights under the Act.

Conclusion

The Digital Personal Data Protection Act, 2023 is a progressive step towards safeguarding individual privacy while fostering a secure and innovative digital economy. By addressing the challenges of data misuse and ensuring accountability, the Act aligns with India’s constitutional values and global best practices, paving the way for a robust data governance framework.