India

What is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 (also known as DPDP Act or DPDPA-2023) is an act of the Parliament of India to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes.

Unique fact: This is the first Act of the Parliament of India where "she/her" pronouns were used, unlike the usual "he/him" pronouns.

Timeline: From Bill to Act

• 18 November 2022: The Ministry of Electronics and Information Technology released the Digital Personal Data Protection Bill, 2022 for public consultation.
• 5 July 2023: The cabinet approved the Digital Personal Data Protection Bill, 2023, which was the revised version of the 2022 bill.
• 3 August 2023: Digital Personal Data Protection Bill, 2023 was introduced in Lok Sabha, the lower house of the Parliament of India.
• 7 August 2023: Digital Personal Data Protection Bill, 2023 was passed by Lok Sabha.
• 9 August 2023: Digital Personal Data Protection Bill, 2023 was introduced and passed by Rajya Sabha, the upper house of the Parliament of India.
• 11 August 2023: President of India gave assent to the Digital Personal Data Protection Bill, 2023, which made it the Digital Personal Data Protection Act, 2023.
• 13 November 2025: Provisions in respect of establishment of the Data Protection Board of India brought into force.

Background: The Right to Privacy Verdict

On 24 August 2017, the Supreme Court of India gave the Right to Privacy verdict. In the case of Justice K. S. Puttaswamy (Retd.) and Anr. vs Union of India And Ors., the Supreme Court held that the Right to Privacy is a fundamental right protected under Article 21 and Part III of the Indian Constitution.

After the verdict, the Government of India set up a data protection framework which started taking steps towards the creation of the data protection legislation after the Supreme Court of India's privacy verdict.

On 22 December 2017, the constitution of a committee of experts to deliberate on a data protection framework for India took place by the chairmanship of Justice B.N. Srikrishna.

After the Government of India constituted an expert committee, the committee sought public consultation on various white papers on data protection framework for India.

The Personal Data Protection Bill, 2018 draft was released. The committee of experts under chairmanship of Justice B.N. Srikrishna released their Data Protection Committee report.

On 14 August 2018, the Ministry of Electronics and Information Technology sought feedback on the Draft Personal Data Protection Bill.

Personal Data Protection Bill, 2019

The Ministry of Electronics and Information Technology set up a committee to study issues related to data protection. The committee was chaired by retired Supreme Court judge Justice B. N. Srikrishna. The committee submitted the draft version of Personal Data Protection in July 2018. The report was later modified several times by the Government of India and, after receiving the approval of central cabinet, the draft legislation was tabled in the Parliament of India on 11 December 2019.

On 4 December 2019, after further deliberations, the Bill was approved by the cabinet ministry of India.

On 11 December 2019, the Personal Data Protection Bill, 2019 was tabled in Lok Sabha and referred to the Joint Parliamentary Committee.

On 16 December 2021, the standing committee submitted its report on the bill.

On 3 August 2022, the Personal Data Protection Bill, 2019 was withdrawn.

Aim of the 2019 Bill

The Bill aimed to provide for protection of the privacy of individuals relating to their personal data, specify the flow and usage of personal data, create a relationship of trust between persons and entities processing the personal data, protect the fundamental rights of individuals whose personal data are processed, create a framework for organisational and technical measures in processing of data, lay down norms for social media intermediary, cross-border transfer, accountability of entities processing personal data, remedies for unauthorised and harmful processing, and to establish a Data Protection Authority of India for the said purposes and for matters connected therewith or incidental thereto.

It provided for extensive provisions around collection of consent, assessment of datasets, data flows and transfers of personal data, including to third countries and other aspects around anonymized and non-personal data.

Criticism and Withdrawal of the 2019 Bill

The revised 2019 Bill was criticized by Justice B. N. Srikrishna, the drafter of the original Bill, as having the ability to turn India into an "Orwellian State". In an interview with Economic Times, Srikrishna said: "The government can at any time access private data or government agency data on grounds of sovereignty or public order. This has dangerous implications."

The role of social media intermediaries is being regulated more tightly on several fronts. The Wikimedia Foundation hoped that the PDP bill would prove the lesser evil compared with the Draft Information Technology [Intermediary Guidelines (Amendment) Rules] 2018.

Forbes India reported that "there are concerns that the Bill gives the government blanket powers to access citizens' data."

The bill, after being tabled, was referred to the JPC which was chaired by Meenakshi Lekhi. After it received criticism from stakeholders, opposition, and experts, the bill was withdrawn from the Parliament of India on 3 August 2022.

Digital Personal Data Protection Bill, 2023

Aim

The Bill provides for the processing of digital personal data in a manner that recognizes both the rights of the individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.

The Digital Personal Data Protection Bill, 2023 is the draft version of the Digital Personal Data Protection Act, 2023. Initially the government released the Digital Personal Data Protection Bill, 2022 on 18 November 2022 for public consultation till 2 January 2023, and approved the revised version of the earlier draft, which was released for public consultation, making it the Digital Personal Data Protection Bill, 2023.

Timeline, Introduction and Passage

• 18 November 2022: The Digital Personal Data Protection Bill, 2022 was released for public consultation; the deadline for receiving comments was 17 December 2022.
• 17 December 2022: The Ministry of Electronics and Information Technology extended the deadline for receiving public comments till 2 January 2023.
• 5 July 2023: The cabinet approved the Digital Personal Data Protection Bill, 2023, which is the revised version of the bill that was put up for public consultation earlier.
• 3 August 2023: The revised version of the Digital Personal Data Protection Bill, 2022 — which is the Digital Personal Data Protection Bill, 2023 — was introduced by Ashwini Vaishnaw, Minister of Electronics and Information Technology, in Lok Sabha.
• 7 August 2023: The bill was passed by Lok Sabha.
• 9 August 2023: The bill was introduced and passed in the upper house of the Indian Parliament, Rajya Sabha.
• 11 August 2023: Draupadi Murmu, President of India, gave assent to the Digital Personal Data Protection Bill, 2023, which made it the Digital Personal Data Protection Act, 2023.

Overview of the Act

The Act protects digital personal data (that is, the data by which a person may be identified) by providing for the following:

• The obligations of Data Fiduciaries (that is, persons, companies, and government entities who process data) for data processing (that is, collection, storage, or any other operation on personal data).
• The rights and duties of Data Principals (that is, the person to whom the data relates).
• Financial penalties for breach of rights, duties, and obligations.
• Establishment of the Data Protection Board of India.

DPDP Act vs GDPR: Key Differences

The DPDP Act, 2023 and the European Union's General Data Protection Regulation (GDPR) share similar principles but differ in key aspects. The DPDP Act applies only to digital personal data, while GDPR covers all forms of personal data. Unlike GDPR, the DPDP Act does not distinguish between personal and sensitive personal data. Both laws grant similar rights to individuals but differ in their approach to legal bases for data processing.

Data Protection Board of India

Under Section 18 of the Digital Personal Data Protection Act, 2023, the Data Protection Board of India is a body that adjudicates the dispute(s) between those whose personal data has been given to a platform and the platform which has in turn breached the obligations under the law.

Rights and Provisions

• Right to access personal data.
• Right to correction and erasure of data.
• Right to revoke consent.
• Special provisions for the protection of data related to minors (under 18 children).
• Minimum penalty for breach is ₹50 crore INR.
• The terms and conditions and information related to collection of data should be made available in all the 22 languages in the 8th Schedule of the Indian Constitution.
• Right to grievance redressal.
• Right to nominate a consent manager to manage their data-related requests on behalf of a data principal (the right to nominate a person to exercise rights in case of death or incapacity).
• The Act does not permit processing which is detrimental to the well-being of children or involves their tracking, behavioral monitoring, or targeted advertising.
• The Act requires notification of data breaches to the Data Protection Board and affected individuals.

Exemptions Under the Act

The Act has made exemptions from the regulations related to the Act. They are:

• The processing of personal data is necessary for enforcing any legal right or claim.
• The processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function.
• Personal data is processed in the interest of prevention, detection, investigation, or prosecution of any offence or contravention of any law for the time being in force in India.
• Personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India.
• The processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies, or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force.
• The processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.

Criticism of the Act

Several points of criticism have been recorded by the Editors Guild of India, Press Club of India, RTI activists, and the INDIA Bloc.

Main criticism: The Act is only applicable to the data collected digitally and when offline data gets digitized. Not having applicability on offline personal data was criticized, as there is no framework on how such data is handled.

Quick Summary