Digital Personal Data Protection Act, 2023

Key Takeaways

• The law is officially called the Digital Personal Data Protection Act, 2023.
• It does not come into force automatically — the Central Government must notify the date.
• Different sections of the Act may start on different dates.

Key Takeaways

• Data Fiduciary = the business or person who decides WHY and HOW data is processed. Most businesses collecting customer data are Data Fiduciaries.
• Data Principal = the individual whose data is collected. Includes parents/guardians when the individual is a child or person with disability.
• Data Processor = a third party (e.g., cloud vendor, CRM tool) processing data on behalf of a Data Fiduciary.
• Personal data breach = any unauthorised access, disclosure, use, alteration, or loss of personal data.
• Processing = extremely broad — covers collection, storage, use, sharing, deletion, and everything in between.
• Child = any individual under 18 years of age.

Key Takeaways

• Covers data collected in digital form OR data collected on paper and later digitised.
• Applies extraterritorially — if a foreign entity offers services to Indian users, this Act applies.
• Excludes personal/domestic use — an individual managing their own contacts is not covered.
• Publicly available data (e.g., social media profile made public by the user) is excluded.

Key Takeaways

• Only two lawful bases: consent (Section 6) or certain legitimate uses (Section 7).
• Lawful purpose means any purpose not forbidden by law — not just regulated purposes.
• Unlike GDPR, there is no 'legitimate interests' ground under DPDPA.
• Every processing activity must map to one of these two grounds.

Key Takeaways

• Notice must come before or alongside the consent request — not after.
• Notice must state: what data is collected, the purpose, how to withdraw consent, and how to file a complaint with the Board.
• For existing customers (pre-Act consent), businesses must send retrospective notices as soon as practicable.
• Language accessibility is mandatory — users must be able to access the notice in their preferred language.

Key Takeaways

• Consent must be: free, specific, informed, unconditional, and unambiguous.
• Data collection must be minimal — only what is necessary for the stated purpose.
• Pre-ticked boxes and bundled consent are invalid.
• Any consent that waives a legal right (e.g., right to complain to the Board) is void.
• Consent can be withdrawn at any time — and the withdrawal must be as easy as giving consent.
• The Data Fiduciary bears the burden of proof that valid consent was obtained.

Key Takeaways

• Clause (a): If a customer shares data for an obvious purpose (e.g., giving a phone number for a delivery), no separate consent notice is needed.
• Clause (b)-(d): Government and legal compliance uses do not need individual consent.
• Clause (i): Employment-related processing (background checks, confidentiality protection) is a legitimate use.
• Key difference from GDPR: No 'legitimate interests' balancing test — these uses are prescribed categories only.

Key Takeaways

• A business cannot escape liability by blaming its vendor — if your processor breaches data, you are still responsible.
• All vendor contracts must explicitly cover data processing obligations.
• Security safeguards are mandatory — breach of this obligation attracts the highest penalty (₹250 crore).
• Breach notification is mandatory — both the Board and affected individuals must be notified.
• Data must be deleted when the purpose is served — you cannot retain data indefinitely.
• A grievance mechanism (a named contact or email) is compulsory.
• Failure to implement security safeguards: penalty up to ₹250 crore. Failure to notify breach: up to ₹200 crore.

Key Takeaways

• Child = under 18 years. Parental/guardian consent is required before any processing.
• Verifiable consent — simply clicking 'I agree' on behalf of a child is insufficient.
• Behavioural tracking and targeted advertising to children are banned.
• Processing that could harm a child's well-being is prohibited.
• Penalty for breach: up to ₹200 crore.
• Certain classes of Data Fiduciaries may be exempted by the Central Government (e.g., age-appropriate, verified-safe platforms).

Key Takeaways

• Not all businesses are SDFs — the Central Government must specifically notify an entity as an SDF.
• SDFs must appoint a Data Protection Officer (DPO) based in India, accountable to the Board of Directors.
• An independent data auditor is required — not an internal team.
• Data Protection Impact Assessments (DPIAs) must be conducted periodically.
• Penalty for breach of SDF obligations: up to ₹150 crore.

Key Takeaways

• Individuals can ask any business: what data do you have about me, what are you doing with it, and who have you shared it with.
• The business must provide a summary and a list of third parties the data was shared with.
• Exception: sharing with law enforcement agencies for investigation or prosecution purposes need not be disclosed.
• A formal process and timeline for responding to access requests will be prescribed in the Rules.

Key Takeaways

• Four rights: correct, complete, update, and erase.
• Businesses must act on correction requests — not just acknowledge them.
• Erasure can be refused only if retention is legally mandated (e.g., tax records, KYC records).
• This right applies where the Data Principal previously gave consent — including voluntary sharing under Section 7(a).

Key Takeaways

• A grievance contact (name, email, or portal) is mandatory — it must be 'readily available', not buried.
• Businesses must respond within the prescribed timeframe (to be specified in Rules).
• Individuals cannot go directly to the Board — they must first try the business's grievance mechanism.
• This requirement applies to both Data Fiduciaries and Consent Managers.

Key Takeaways

• A unique right — allows a 'data nominee' similar to a nominee in a bank account.
• The nominee can exercise all data rights (access, correction, erasure, grievance) on behalf of the Data Principal.
• Applicable in cases of death, unsoundness of mind, or physical incapacity.
• The manner of nomination will be prescribed in the Rules.

Key Takeaways

• The Act is not one-sided — individuals have duties, not just rights.
• Providing false information, impersonating others, or filing frivolous complaints are violations.
• Penalty for breach of duties: up to ₹10,000 (Schedule Item 5).
• This provision protects businesses from bad-faith data access requests.

Key Takeaways

• DPDPA does not impose a blanket data localisation requirement — cross-border transfer is allowed by default.
• The Central Government can create a 'restricted countries' list by notification — any country on this list will be blocked.
• Sector-specific localisation rules (e.g., RBI's payment data localisation) continue to apply alongside DPDPA.

Key Takeaways

• Law enforcement and courts are largely exempt from consent and rights obligations.
• Startups and small businesses may be exempt from Section 5 (Notice), data accuracy, data erasure, SDF obligations, and right to access.
• The Central Government has a 5-year window to grant sector-specific or entity-specific exemptions.
• Section 8(1) (overall responsibility) and Section 8(5) (security safeguards) are NOT exempt — even law enforcement must maintain security.
• Research and archiving are exempt if data is not used to make individual-level decisions.

Key Takeaways

• Penalties are not automatic — the Board must conclude an inquiry first.
• The business must be given an opportunity to be heard before any penalty is imposed.
• Only 'significant' breaches attract penalties under this section.
• 7 factors must be considered by the Board when quantifying the penalty amount.
• Taking prompt corrective action (factor e) can reduce the penalty amount.
• The Schedule lists maximum penalties — the Board can impose any amount up to the maximum.

Key Takeaways

• Section 43A of the IT Act (data breach compensation) is repealed — DPDPA now governs this.
• The DPDPA Appellate Tribunal (under TRAI) is the forum for all appeals.
• RTI exemption for personal information is updated to align with DPDPA.