Why in the news?

  • The Union government notified large parts of the Digital Personal Data Protection (DPDP) Act, 2023, addressing the need for a law to protect the data privacy of Indian citizens.

Digital Personal Data Protection Act, 2023

  • Aim: To safeguard the digital personal data of individuals while promoting the responsible use of data for innovation and economic growth.
  • Key Features:
    • Applicability: Covers digital personal data processed within India and outside if it involves Indian citizens.
    • Rights of Individuals (Data Principals)
      • Right to Information: Know how their data is used.
      • Right to Correction/Erasure: Request corrections or deletion of personal data.
      • Right to Grievance Redressal: Access mechanisms to address data misuse.
    • Obligations of Organizations (Data Fiduciaries)
      • Ensure transparency, purpose limitation, and data security.
      • Set up grievance redressal mechanisms for complaints.
    • Data Protection Board (DPB): Statutory body to oversee compliance and address grievances.
    • Penalties: Fines up to ₹250 crore for data breaches and non-compliance.
    • Cross-Border Data Transfers: Allows data transfers to notified countries with adequate protections.
    • Children’s Data:
      • Requires parental consent for processing data of individuals under 18.
      • Prohibits tracking or behavioral profiling of children.
    • Exemptions for Government Agencies: Government entities can be exempt for national security, public order, and strategic interests.
    • Significant Data Fiduciaries: Large-scale data processors are subject to additional audits and compliance measures.
  • Concerns:
    • Government Exemptions: Raises surveillance and misuse concerns.
    • Independence of DPB: Board under Ministry of IT may affect impartiality.
    • Vague Terms: Terms like “reasonable safeguards” lack precise definitions.
  • Importance:
    • Aligns India’s data protection with global standards like GDPR.
    • The DPDP Rules, 2025 are also a significant step forward in compliance with the Supreme Court’s 2017 K.S. Puttaswamy v. Union of India judgment affirming the right to privacy.
    • Empowers individuals with control over their data.
    • Balances privacy protection with economic growth.