India’s New Law to Protect Digital Personal Data: What You Need to Know 🙋
The DPDP Act safeguards India’s digital privacy rights and promotes trust and transparency online.
India has taken a major step towards safeguarding the privacy and security of its citizens’ digital personal data. On Saturday, August 12, 2023, the Digital Personal Data Protection (DPDP) Act, 2023 received the assent of the President of India, making it a law. The DPDP Act was passed by both houses of Parliament in the monsoon session earlier this week.
The DPDP Act is a landmark legislation that aims to regulate the processing of digital personal data in a manner that respects the right of individuals to protect their personal data and the need to process such data for lawful purposes. The Act also seeks to promote the ease of living and the ease of doing business in India, as well as to enable India’s digital economy and its innovation ecosystem.
The Act defines digital personal data as any data that can identify an individual, either by itself or in relation to other data, and that is in digital form. The Act applies to the processing of digital personal data in India, whether the data is collected in digital form or in a non-digitized format and subsequently digitized. The Act also applies to the processing of digital personal data outside India, if the data relates to individuals in India or is used for offering goods or services to them.
The Act introduces several rights and obligations for individuals and entities involved in the processing of digital personal data. Some of the key features of the Act are:
- The Act establishes a Data Protection Board of India (DPB), which will be an independent statutory body responsible for overseeing and enforcing the implementation of the Act. The DPB will have power to issue regulations, guidelines, codes of practice, and orders relating to various aspects of data protection. The DPB will also have powers to investigate, adjudicate, and impose penalties for violations of the Act.
- The Act requires entities that process digital personal data, called Data Fiduciaries, to obtain the consent of individuals, called Data Principals, before collecting or using their data. The consent must be free, informed, specific, clear, and revocable. The Data Fiduciaries must also provide clear and transparent information about the purpose, manner, duration, and recipients of the data processing. The Data Fiduciaries must also ensure that the data processing is fair, lawful, reasonable, and necessary for the specified purpose.
- The Act grants several rights to Data Principals over their digital personal data. These include the right to access, correct, erase, port, restrict, or object to the processing of their data. The Data Principals also have the right to withdraw their consent at any time and to nominate a person to exercise their rights in case of death or incapacity. The Data Principals can exercise their rights by contacting the Data Fiduciaries directly or by filing a complaint with the DPB.
- The Act imposes certain obligations on Data Fiduciaries to ensure the security and integrity of digital personal data. These include implementing appropriate technical and organizational measures to prevent unauthorized access, disclosure, alteration, or destruction of data; notifying the DPB and the affected Data Principals of any personal data breach within 72 hours; erasing or anonymizing personal data when it is no longer needed for the specified purpose; conducting periodic data protection impact assessments; appointing a data protection officer; and undergoing independent audits by certified data auditors
- The Act provides for exemptions from some or all of its provisions for certain categories of data processing. These include processing for national security, public order, legal proceedings, research, journalism, personal or domestic purposes, and any other purpose specified by the Central Government. However, such exemptions are subject to certain conditions and safeguards prescribed by the Act or by the DPB
- The Act prescribes stringent penalties for violations of its provisions or orders issued by the DPB. The penalties range from Rs 10 lakh to Rs 250 crore or 4% of global turnover (whichever is higher) depending on the nature and severity of the violation. The penalties are in addition to any compensation that may be awarded to the affected Data Principals or any criminal liability that may arise under other laws.
The DPDP Act is expected to have a significant impact on various sectors and stakeholders in India’s digital ecosystem. It will require businesses and organizations that process digital personal data to comply with new standards and obligations that may entail changes in their policies, practices, systems, and contracts. It will also empower individuals with greater control and choice over their digital personal data and provide them with effective remedies in case of any misuse or breach.
The DPDP Act is a welcome step towards establishing a robust legal framework for digital personal data protection in India. It is a reflection of India’s commitment to uphold the fundamental right to privacy of its citizens and to foster a culture of trust and transparency in the digital space. It is also a recognition of the potential and opportunities of the digital economy and the need to balance innovation and regulation in a dynamic and evolving environment. 👏