The Digital Personal Data Protection Act, 2023 began as a Bill passed in the Lok Sabha on 7th August 2023. It lays down the obligations of entities that collect and process personal data, along with the rights of the individuals whose data is being collected, and it carries real teeth: the Act allows for a penalty of up to Rs 250 crore, with a floor of Rs 50 crore, on entities found violating its norms.
It has become commonplace to grant consent for personal data collection across a multitude of apps and websites, often without much thought, since convenience usually wins out over caution. But the data being handed over so casually today has the potential to come back and complicate things tomorrow.
What the Act Covers
The Digital Personal Data Protection Bill of 2022, the draft that preceded this Act, set out how personal data could be processed while still protecting an individual's right to control that data and ensuring it is used only for lawful purposes. That principle carried through into the Act as it stands today.
Who the Act Applies To
The Act's obligations broadly fall on two kinds of parties:
- Data Principal
- Data Fiduciary
Data Principal, as defined in Section 2(6), means:
"the individual to whom the personal data relates, and where such individual is a child, includes the parents or lawful guardian of such a child."
In simple terms, a Data Principal is the individual whose data is being collected. The Act grants Data Principals certain rights, including the right to obtain information about their data, seek its correction, and have it erased.
Data Fiduciary, as defined in Section 2(5), means:
"any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data."
A Data Fiduciary must ensure that any personal data collected with consent is protected, and must have a procedure in place to redress grievances. It should also ensure that data is retained only for a fixed duration, and that reasonable security safeguards are in place to prevent a data breach.
Consent Comes First
The Act is clear that data can be collected only after consent has been obtained, and that a Data Principal must be informed of the purpose for which their data will be used before it is collected.
Consent obligations run both ways. It must be obtained without infringing the Act, and a Data Principal has the right to withdraw that consent as easily as they gave it. This has real operational consequences: apps and e-commerce platforms need standard operating procedures that keep pace with the law, and if a company changes its terms and conditions, its previously obtained consent no longer holds, fresh consent has to be sought from the Data Principal.
A Data Protection Officer, akin to a Grievance Officer, is mandated under the Act to resolve grievances raised by individuals under its provisions.
Where Things Stand Today
The Digital Personal Data Protection Bill has since been passed by the Parliament of India and is now in force as law.
The DPDP Act is worth understanding before handing over personal data on any application or website, and it is equally worth understanding if your business is the one collecting that data. It retains several provisions carried over from earlier drafts alongside newer ones, and its rules will likely keep evolving as they are tested in practice. We will continue to track those developments here.
Disclaimer: The content of this article is intended to provide general guidance on the subject matter. Specialist advice should be sought about your specific circumstances.