Digital Personal Data Protection Act, 2023 (DPDP Act)

India, a country with a rich legal history, has recently taken a significant step towards safeguarding digital rights. The Digital Personal Data Protection Act, 2023 (DPDP Act) is a landmark legislation that aims to protect individual privacy and regulate the governance of personal data collected by organizations.

Introduction

The DPDP Act introduces several key concepts:

• Lawful basis of processing: The Act consolidates the lawful basis of processing to consent and certain legitimate uses.
• Data localisation rules: These rules have been relaxed, allowing transfers across jurisdictions unless specifically notified.
• Data processing agreements: These are mandatory before outsourcing activities to third parties.
• Financial penalties: Penalties up to INR 250 crore per instance of non-compliance with the law are stipulated.
• Data Protection Impact Assessments: These are made mandatory for Significant Data Fiduciary.
• Personal data in public domain: This is excluded from scope.

Legal Points and Common Concerns

The DPDP Act has been designed with privacy at its core. It empowers individuals and redefines business practices, ushering in responsible data handling. However, it also raises some common concerns:

• Cross-border data transfers: The Act introduces a negative-list regime for these transfers.
• Exemptions: Data made publicly available by a data principal or under legal obligation is exempted. Data fiduciaries are also exempted from parental consent and other children’s data processing obligations in certain cases.
• Government powers: The government has powers to block access to the data fiduciary’s platform, among several others.

Case Study

The DPDP Act is expected to redefine business practices. For instance, companies will now have to obtain explicit consent from individuals before collecting their personal data. This could potentially impact sectors like e-commerce and digital marketing, which rely heavily on user data.

Exemptions and extensions

Even though the government expects the transition to the law to be completed within 12 months, it has provisions for exemptions and extension.

•         Some government entities, MSMEs, and startups may be exempted from complying with the law immediately

•         Other provisions, such as age-gating, may require a longer amount of time for compliance

Before any rules of the DPDP Act are brought into effect, the government will hold consultation with the industry.

FAQ

Q: What is the Digital Personal Data Protection Act, 2023? A: The DPDP Act is a landmark legislation passed by the Indian Parliament that aims to protect individual privacy and regulate the governance of personal data collected by organisations.

Q: What are the penalties for non-compliance with the DPDP Act? A: The Act stipulates financial penalties up to INR 250 crore per instance of non-compliance with the law.

Q: Are there any exemptions under the DPDP Act? A: Yes, personal data made publicly available by a data principal or under legal obligation is exempted from the scope of the Act.

Conclusion

The Digital Personal Data Protection Act, 2023 is indeed a historic milestone in India’s digital rights journey. It not only empowers individuals but also ushers in a new era of responsible data handling. As we navigate this new landscape, it’s crucial for businesses and individuals alike to understand and comply with this law.

At Advocate Aid, we are dedicated to offering exceptional legal services to individuals in Jammu & Kashmir, India. As advocates registered with the Bar council of Jammu Kashmir High Court and based in the Anantnag district court, we possess a deep understanding of the complexities of various laws and procedures. Our online platform offers free legal assistance in a user-friendly manner. For any legal concerns, feel free to contact us via call or WhatsApp. Depend on Advocate Aid for comprehensive legal solutions.