Q.10. Describe the context and salient features of the Digital Personal Data Protection Act, 2023. [UPSC 2024 GS P-3]

The Digital Personal Data Protection Act, 2023 (DPDP Act) marks a significant milestone in India’s regulatory framework for data privacy and protection. It was introduced to provide a comprehensive law governing the collection, processing, and storage of digital personal data, balancing the rights of individuals with the legitimate needs of businesses and the government.

Context of the DPDP Act, 2023

1. Need for Data Protection: With the rapid growth of digital infrastructure in India, there was a pressing need for a robust law to safeguard personal data in the digital age. The absence of a comprehensive legal framework led to concerns about privacy breaches, unauthorized use of personal data, and lack of accountability by data processors.
2. Supreme Court’s Ruling: In the Puttaswamy vs Union of India (2017) case, the Supreme Court of India declared the Right to Privacy as a fundamental right under Article 21 of the Constitution. This ruling intensified the need for legislative measures to protect individuals’ personal data from misuse.
3. Global Data Protection Trends: Several global regimes, notably the European Union’s General Data Protection Regulation (GDPR), set new benchmarks for privacy laws, influencing India’s efforts to create its own data protection framework.
4. Digital India: With initiatives like Digital India and the exponential increase in digital transactions, it became essential for India to implement data protection laws that ensure citizens’ privacy while promoting the ease of doing business in the digital economy.

Salient Features of the Digital Personal Data Protection Act, 2023

1. Scope and Applicability:
   • The DPDP Act applies to the processing of personal data that is digitally collected from individuals (referred to as “data principals”) and used by organizations (referred to as “data fiduciaries”) within India.
   • It also applies to any digital data collected outside India if it is being processed to offer goods or services within India.
2. Key Definitions:
   • Data Principal: The individual whose personal data is being collected or processed.
   • Data Fiduciary: Any entity or individual that determines the purpose and means of processing the personal data of individuals.
   • Personal Data: Any data that can directly or indirectly identify an individual.
3. Consent-based Data Collection:
   • The Act mandates that data fiduciaries can process personal data only with informed consent from the data principal. The consent must be explicit, and individuals should be informed about the purpose and manner of data collection.
   • Data principals also have the right to withdraw consent at any time, with the data fiduciary being obligated to stop processing data when consent is withdrawn.
4. Data Principals’ Rights:
   • Right to Information: Data principals have the right to know what personal data is being collected and processed.
   • Right to Correction and Erasure: Individuals can request the correction or deletion of their personal data if it is inaccurate or no longer required for the specified purpose.
   • Right to Grievance Redressal: If there is a violation of the data principal’s rights, they can lodge complaints with the Data Protection Board.
5. Obligations of Data Fiduciaries:
   • Data fiduciaries must ensure that personal data is processed in a lawful, fair, and transparent manner.
   • Data minimization: Fiduciaries are required to collect only the data necessary for the stated purpose and ensure that it is stored for only as long as required.
   • Security Safeguards: Fiduciaries are mandated to implement reasonable security measures to prevent unauthorized access, data breaches, or leaks.
6. Significant Data Fiduciaries:
   • Certain data fiduciaries who process large volumes of personal data or deal with sensitive information are designated as Significant Data Fiduciaries (SDFs). These fiduciaries are subject to stricter obligations, including conducting regular data protection impact assessments, audits, and appointing a Data Protection Officer (DPO).
7. Cross-border Data Transfers:
   • The Act allows cross-border data transfers to countries or territories approved by the Central Government. This provision offers businesses flexibility while ensuring that personal data is transferred only to jurisdictions that maintain similar levels of data protection.
8. Grievance Redressal Mechanism:
   • The Act establishes a Data Protection Board (DPB), which will address grievances, resolve disputes, and ensure compliance with the law. The DPB has the authority to impose penalties on organizations for non-compliance or breach of data privacy provisions.
9. Penalties for Non-compliance:
   • The DPDP Act includes provisions for hefty penalties for violations:
     • Up to ₹250 crore for data breaches or failure to implement proper safeguards.
     • Up to ₹200 crore for non-compliance with other provisions, such as failing to ensure consent or violating the rights of data principals.
10. Exemptions:

• The government may exempt certain agencies from the provisions of the DPDP Act in the interest of national security, public order, or safeguarding the sovereignty and integrity of India.
• Processing of personal data for research or journalistic purposes is also exempt from certain provisions of the Act to maintain freedom of expression and innovation.

11. Data Localization:

• Unlike earlier drafts, the DPDP Act does not impose strict data localization requirements, meaning that companies can store personal data outside India, provided it is shared only with trusted jurisdictions approved by the government.

12. Parental Consent for Minors:

• For individuals under the age of 18, parental consent is required for data collection and processing, thus safeguarding minors from potential misuse of their data.

Conclusion

The Digital Personal Data Protection Act, 2023 represents a balanced approach to safeguarding individuals’ privacy while enabling the growth of the digital economy. It addresses many critical issues such as consent, data minimization, and accountability while giving citizens significant rights over their personal data. However, its success will largely depend on effective implementation, awareness among stakeholders, and the cooperation of private entities in adhering to its provisions. The DPDP Act marks a significant step toward enhancing digital trust in India’s rapidly expanding digital ecosystem.