A Definitive Guide to DPDP: India’s Digital Personal Data Protection Act
Harsh Sahu
CTO
March 2024 | 11 mins
India is now among the 130+ countries with legislated and enforced act to regulate data, aiming to protect the privacy of its 1.4 billion residents.
This blog discusses the act's brief history, its various provisions, and the importance of businesses protecting their customers' sensitive and personal data to remain compliant in the dynamic data security landscape.
Businesses seeking to establish a strong presence in the Indian market must understand and apply the appropriate measures to maintain continuous compliance with these regulations.
India's new Digital Personal Data Protection Act legislates the processing of digital personal data, balancing individuals' rights to data protection and lawful data processing needs.
The Indian data privacy law was enacted on August 11th, 2023 and is likely to be in force in 2024.
Let’s look at how the Indian privacy law came into being:
Personal data is defined under India’ Digital Data Protection Act as any data about an individual who is identifiable by or in relation to such data.
An individual can only process the personal data of a Data Principal in compliance with this Act and for a lawful purpose:
(a) for which the Data Principal has consented; or
(b) for certain legitimate uses.
The scope of DPDP and who must comply with the act is given below:
Data Principal means the individual to whom the personal data relates and where such individual is a child, includes the parents or lawful guardian of such a child and a person with disability, includes her lawful guardian, acting on her behalf.
Read more on why regulatory compliance with data privacy law is necessary.
There are several unique definitions under the latest DPDP legal framework:
This refers to an individual registered with the Data Protection Board of India.
Their role is to act as a single point of contact, aiding a Data Principal in granting, managing, reviewing, and withdrawing consent through a platform that is accessible, transparent, and interoperable.
This refers to an individual who, either alone or with others, decides on the purpose and method of processing personal data.
The government specifically identifies these data fiduciaries based on their data volume, sensitivity, risk, and impact on national interests.
Significant Data Fiduciaries (SDFs) are subject to additional requirements, such as the appointment of an India-based Data Protection Officer (DPO).
This refers to the individual to whom the personal data pertains. If the individual is a child, it includes the child's parents or legal guardian.
Similarly, for a person with a disability, it includes their legal guardian acting on their behalf.
This refers to an office that uses an online mechanism.
It conducts proceedings, from the receipt of intimation, complaint, reference, directions, or appeal, to their disposal, entirely in an online or digital mode.
India’s first-ever privacy act vastly mirrors EU’s GDPR privacy law, by retrofitting it into India’s context.
The key provisions of DPDPA 2023 are highlighted below.
Data protection laws provide certain rights to data principals.
Consumer rights under DPDP act rights highlight the various ways through which individuals can protect their personal data.
The Data Principal has the right to access their personal data from the Data Fiduciary.
This includes obtaining a summary of the processed data, information on data sharing with other fiduciaries or processors, and any additional relevant details.
However, this right does not extend to data shared legally with other fiduciaries for legal or investigative purposes.
Under the DPDP Act, the Data Principal has the right to request the correction, completion, updating, or erasure of their personal data from the Data Fiduciary.
The Fiduciary must comply with requests to amend inaccurate or incomplete data and delete personal data unless it is retained for a specific purpose or legal compliance.
Requests must be made in a prescribed manner.
The right to grievance redressal allows Data Principals to seek resolution from Data Fiduciaries or Consent Managers regarding issues related to personal data handling or rights under the Act.
Data Fiduciaries or Consent Managers must address grievances within a prescribed timeframe.
Data Principals are required to utilize this internal grievance mechanism before approaching the overseeing Board for further redressal.
The right to nominate allows Data Principals to appoint an individual who can exercise their data protection rights in cases of the Data Principal's death or incapacity.
This ensures continuity in the protection and management of the Data Principal's personal data in accordance with the Act's provisions.
A Data Principal must:
(a) comply with all laws while exercising rights under this Act
(b) not impersonate others while providing personal data
(c) not suppress material information when providing personal data for any state-issued document or proof
(d) avoid false or frivolous complaints with a Data Fiduciary or the Board
(e) only provide verifiably authentic information when exercising the right to correction or erasure under this Act
Violation of duties will be punishable with a penalty of up to INR 10,000 or $120 USD.
The entity determining the purpose and means of processing, (data fiduciary), must:
The act allows transfer of personal data outside India, except to countries restricted by the central government through notification.
Rights of the data principal and obligations of data fiduciaries (except data security) will not apply in specified cases.
These include:
The central government has to establish the Data Protection Board of India.
Key functions of the Data Protection Board of India include
Board members will be appointed for two years and will be eligible for re-appointment.
The central government will prescribe details such as the number of members of the Board and the selection process.
Appeals against the decisions of the Board will lie with Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
India’s first data protection law specifies penalties for various offences such as up to:
Penalties will be imposed by the Board after conducting an inquiry.
DPDPA data processing rules does not apply to:
Navigating the complex landscape of data protection, particularly with the implementation of the DPDPA requirements for businesses is becoming increasingly challenging.
With India emerging as a hotspot for data breaches, it is essential for businesses to prioritize compliance with the DPDP Act.
India ranked 5th in the list of most breached countries with 5.3 million leaked accounts in 2023. These numbers underscore the urgency of robust data protection measures.
In such situations, OptIQ serves as an invaluable partner for businesses, helping you leverage state-of-the-art compliance management and data security solutions.
Businesses can ensure they are compliant with the DPDP Act and other data protection regulations, thus protecting their valuable customer data and maintaining their reputation in the market.
The GDPR places direct compliance obligations on data processors also subjecting them to penalties for non-compliance. The DPDP Act does not impose obligations on data processors. Instead, the responsibility lies with the Data Fiduciaries (controllers) to ensure compliance by the processors they engage.
The GDPR outlines 8 fundamental rights for individuals regarding their personal data: the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights in relation to automated decision-making and profiling. India's DPDP act outlines 4 rights of data principal or the individuals such as right to access, right to correction and erasure, right to grievance redressal and right to nominate.
The GDPR and the DPDPA are both comprehensive data protection laws that share a number of similarities, including: They both grant individuals a number of rights over their personal data, such as the right to access, erase, and object to the processing of their personal data.
