Digital Personal Data Protection Act, 2023

Digital Personal Data Protection Act, 2023
Parliament of India
Long title An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
Citation	Act No. 22 of 2023
Territorial extent	Indien
Passed by	Lok Sabha
Passed	7 August 2023
Passed by	Rajya Sabha
Passed	9 August 2023
Assented to by	President of India
Assented to	11 August 2023
Legislative history
First chamber: Lok Sabha
Bill citation	Bill No. 113 of 2023
Introduced by	Ashwini Vaishnaw Minister of Electronics and Information Technology, Minister of Communications, Minister of Railways
First reading	3 August 2023
Keywords
Consent, Data privacy, Data breach
Status: Not yet in force

The Digital Personal Data Protection Act, 2023 (also known as DPDP Act or DPDPA-2023) is an act of the Parliament of India to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto. This is the first Act of the Parliament of India where "she/her" pronouns were used unlike the usual "he/him" pronouns.

The Minister of Electronics and Information Technology Ashwini Vaishnaw has informed that the Central government is setting up the Data Protection Board of India which will be an independent body. It will monitor compliance and imposition of penalties, direct data fiduciaries to take necessary measures in the event of a data breach and hear grievances made by affected persons.

Background

In July 2017, the Ministry of Electronics and Information Technology set up a committee to study issues related to data protection. The committee was chaired by retired Supreme Court judge Justice B. N. Srikrishna. The committee submitted the draft Personal Data Protection Bill, 2018 in July 2018.

On 24 August 2017, the Supreme Court of India gave the Right to Privacy verdict. In the case of Justice K. S. Puttaswamy (Retd.) and Anr. vs Union Of India And Ors., the Supreme court held that the Right to Privacy is a fundamental right protected under Article 21 and Part III of the Indian Constitution.

After further deliberations the Bill was approved by the cabinet ministry of India on 4 December 2019 as the Personal Data Protection Bill, 2019 and tabled in the Lok Sabha on 11 December 2019. The Data Protection Bill, 2019 was withdrawn from the Lok Sabha and the Parliament of India as reported in the Bulletin - Part 1 No. 189 dated August 3, 2022.

In November 2022, The Ministry of Electronics and Information Technology introduced a new bill for public consultation. The Digital Personal Data Protection Bill, 2023 was passed by Lok Sabha on 7 August 2023. and by Rajya Sabha on 9 August 2023. On 11 August 2023, the President of India gave assent to the Digital Personal Data Protection Bill, 2023 which now makes it Digital Personal Data Protection Act, 2023.

Übersicht

• The Act protects digital personal data (that is, the data by which a person may be identified) by providing for the following
  • The obligations of Data Fiduciaries (that is, persons, companies and government entities who process data) for data processing (that is, collection, storage or any other operation on personal data)
  • The rights and duties of Data Principals (that is, the person to whom the data relates)
  • Financial penalties for breach of rights, duties and obligations
  • Establishment of Data Protection Board of India

Rights and provisions

• Right to access she/her personal data
• Right to correction and erasure of data
• Right to revoke consent
• Special provisions for the protection of data related minors (under 18 children)
• Minimum penalty for breach is 50 crore INR
• The terms and conditions and information related to collection of data should be made available in all the 22 languages in the 8th schedule of the Indian constitution
• Right to grievance redressal
• Right to nominate a consent manager to manage their data related requests on behalf of a data principle (The right to nominate a person to exercise rights in case of death or incapacity)
• The Act does not permit processing which is detrimental to well-being of children or involves their tracking, behavioral monitoring or targeted advertising

Exemptions^

The Act has made exemptions from the regulations related to the Act, they are:

• The processing of personal data is necessary for enforcing any legal right or claim
• The processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function
• Personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India
• Personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India
• The processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force
• The processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force

See also

• Personal Data Protection Bill, 2019
• Information privacy law
• UK Data Protection Act 2018
• EU General Data Protection Regulation
• UK Data Protection Act 1998
• Data security