Describe the context and salient features of the Digital Personal Data Protection Act, 2023

Introduction

You can start your answer by mentioning the significance of Digital Personal Data Protection.

• The Digital Personal Data Protection (DPDP) Act, 2023 was enacted to create a comprehensive legal framework for protecting personal data in India. 
• The DPDP Act aims to protect individual privacy, ensure data security, and regulate the processing of personal data while maintaining a balance between protecting individual rights and enabling innovation in the digital economy.

Context of Digital Personal Data Protection (DPDP) Act, 2023

• Judicial Recognition of Privacy: In 2017, the Supreme Court of India recognized the right to privacy as a fundamental right under Article 21 in the Puttaswamy Judgment. 
• The conceptual basis of the DPDP Act is the report of the Expert Committee set up under the chairmanship of Justice BN Srikrishna, which led to the introduction of the Personal Data Protection Act in 2019. 
• Global Standards: The need to align Indian laws with global data protection frameworks like the General Data Protection Regulation (GDPR) (2019) of the European Union.
• After several iterations and consultations, the Digital Personal Data Protection Act, 2023, was introduced and subsequently passed by both the Lok Sabha and the Rajya Sabha. 

Salient Features of the DPDP Act, 2023

• Applicability:
  • The DPDP Act applies to the processing of digital personal data in India, whether collected online or offline and later digitised.
  • It also applies to data processing outside India if the data pertains to providing goods or services to data principals (individuals) within India.
• Key Stakeholders:
  • Data Principal (DP): The individual or entity whose personal data is being processed. The DP has the right to provide consent, withdraw it, and even restrict the use of their data.
  • Data Fiduciary: The entity that collects, stores, or shares personal data. A fiduciary can also act as a “Consent Manager” to enable the data principal to manage and review their consent. Significant Data Fiduciaries will be identified based on their systemic impact.
  • Data Processor: An entity that processes data on behalf of the data fiduciary. Both can be the same in some cases, particularly in small entities.
• Citizen’s Rights:
  • Right to Information: The DP has the right to know how their data is being used.
  • Right to Correction and Erasure: The DP can request corrections or erasure of their personal data.
  • Grievance Redressal: The DP has the right to approach authorities for grievances related to data breaches or misuse.
  • Right to Nominate: In case of death or incapacity, the DP can nominate someone to exercise their rights.

• Data Protection Board of India (DPBI):
  • An independent body responsible for resolving disputes related to privacy and data protection.
  • It has the authority to impose penalties for non-compliance and breaches of the Act.
  • Appeals against DPBI orders can be made to the High Court, which can also take up breaches suo moto.
• Penalty Provisions:
  • Financial penalties can range from ₹250 crores for significant breaches by data fiduciaries or processors, down to ₹10,000 for data principals for minor infractions.
  • The Act does not impose criminal penalties but focuses on financial deterrents to ensure compliance.
• Conflict with Existing Laws:
  • The DPDP Act does not supersede other laws but takes precedence in case of conflict with any other legislation.

Conclusion

The DPDP Act, 2023, is key to protecting personal data and privacy in the digital age. Its success depends on strong implementation, grievance redressal, and balanced regulation. As India shifts to a data-driven economy, the Act can bridge innovation and privacy, marking a milestone in digital governance.

Sharing is caring!