Introduction
The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces significant compliance obligations for companies operating in India. One of the most critical questions for corporate boards and directors is: Can directors be held personally liable for data protection failures?
Director Liability under the DPDP Act
The DPDP Act imposes obligations on "data fiduciaries" — entities that determine the purpose and means of processing personal data. Under the Act, directors can be held personally liable if they are found to be "directly in charge of and responsible for the conduct of the business."
Key Liabilities
- Personal Penalties: Directors can be personally fined for non-compliance
- Disqualification: Directors may be disqualified from holding office
- Criminal Liability: In cases of wilful non-compliance, criminal proceedings may be initiated
Board Responsibilities
Boards must ensure that their organisations have robust data protection frameworks in place. This includes:
For a complete understanding of the legal framework, read our DPDPA 2023 Complete Guide.
- Appointing a Data Protection Officer (DPO)
- Implementing consent management mechanisms
- Conducting Data Protection Impact Assessments (DPIAs)
- Establishing data breach response protocols
CEO Accountability
The CEO, as the chief executive officer of the company, bears ultimate responsibility for data protection compliance. CEOs must ensure that data protection is treated as a strategic priority, not just a legal obligation.
Compliance Requirements
Companies must comply with the following key requirements:
- Notice and Consent: Provide clear notices and obtain valid consent
- Data Security: Implement reasonable security safeguards
- Data Breach Notification: Notify the Board and affected individuals within 72 hours
- Data Subject Rights: Enable individuals to exercise their rights
Conclusion
Directors and boards must take proactive steps to ensure compliance with the DPDP Act. Personal liability is a real risk that can be mitigated through proper governance, training, and implementation of robust data protection frameworks.
Related Reading
- Obligations of Data Fiduciaries — Board-level compliance responsibilities
- DPDPA Penalties — What happens when boards fail to comply
- DPDPA 2023 Complete Guide — End-to-end guide to the Act