{"id":320,"date":"2023-06-03T08:15:20","date_gmt":"2023-06-03T08:15:20","guid":{"rendered":"https:\/\/maag.codesupply.co\/gear\/?p=320"},"modified":"2025-01-14T00:41:59","modified_gmt":"2025-01-13T19:11:59","slug":"the-digital-personal-data-protection-act-2023-a-new-era-for-data-privacy-in-india","status":"publish","type":"post","link":"https:\/\/karma.law\/insights\/criminal-law-in-india\/the-digital-personal-data-protection-act-2023-a-new-era-for-data-privacy-in-india\/","title":{"rendered":"The Digital Personal Data Protection Act, 2023: A New Era for Data Privacy in India"},"content":{"rendered":"

The\u00a0<\/span>Digital Personal Data Protection Act, 2023 (DPDPA)<\/span><\/strong><\/a>\u00a0marks a significant milestone in India’s legal framework for safeguarding personal data in the digital age. After several iterations, the final Act received Presidential assent on August 11, 2023, and is set to come into force in 2024. This blog post will delve into the key aspects of this new law, its implications, and what it means for individuals and organizations in India.<\/span><\/p>\n

Understanding the DPDPA<\/span><\/h3>\n

The DPDPA aims to provide a comprehensive framework for processing digital personal data in a lawful manner, balancing the rights of individuals to protect their data with the need for organizations to process data for legitimate purposes. The Act emphasizes accountability, transparency, data minimization, fairness, accuracy, and lawful processing of personal data. Notably, the DPDPA uses “she\/her” pronouns to refer to Data Principals, reflecting a new level of gender sensitivity in Indian law.<\/span><\/p>\n

Core Elements of the DPDPA<\/span><\/h3>\n
    \n
  1. \n

    Data Principals:<\/span><\/strong>\u00a0The Act recognizes the rights of individuals (Data Principals) over their personal data, including the right to give, manage, review, and withdraw consent.<\/span><\/p>\n<\/li>\n

  2. \n

    Data Fiduciaries:<\/span><\/strong>\u00a0These are organizations that determine the purpose and means of processing personal data. They have specific obligations to comply with the Act.<\/span><\/p>\n<\/li>\n

  3. \n

    Data Processors:<\/span><\/strong>\u00a0These are entities that process data on behalf of Data Fiduciaries.<\/span><\/p>\n<\/li>\n

  4. \n

    Significant Data Fiduciaries (SDF):<\/span><\/strong>\u00a0A special category of Data Fiduciaries, notified by the government, that have additional compliance requirements based on their scale and impact.<\/span><\/p>\n<\/li>\n

  5. \n

    Consent Manager:<\/span><\/strong>\u00a0A registered entity that facilitates the management of data principals\u2019 consent.<\/span><\/p>\n<\/li>\n

  6. \n

    Data Protection Board (DPB):<\/span><\/strong>\u00a0The enforcement authority under the DPDPA, responsible for overseeing compliance and addressing grievances.<\/span><\/p>\n<\/li>\n

  7. \n

    Telecom Disputes Settlement and Appellate Tribunal (TDSAT):<\/span><\/strong>\u00a0The appellate authority under the DPDPA.<\/span><\/p>\n<\/li>\n<\/ol>\n

    What is Personal Data?<\/span><\/h3>\n

    The DPDPA defines personal data as “any data about an individual who is identifiable by or in relation to such data.” This covers a broad range of information that can directly or indirectly identify a person.<\/span><\/p>\n

    What is a Personal Data Breach?<\/span><\/h3>\n

    A personal data breach is defined as “any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.” All breaches, regardless of whether they cause damage, must be reported to both the Data Principals and the Data Protection Board.<\/span><\/p>\n

    Penalties for Violations Under the DPDPA<\/span><\/h3>\n

    The Act imposes significant penalties for violations, depending on the nature and severity of the breach. Some of the penalties include:<\/span><\/p>\n