The Digital Personal Data Protection Act, 2023 (also known as DPDP Act or DPDPA-2023) is an act of the

Parliament of India The Parliament of India (ISO 15919, ISO: ) is the supreme legislative body of the Government of India, Government of the Republic of India. It is a bicameralism, bicameral legislature composed of the Rajya Sabha (Council of States) and the Lok ...

to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto. This is the first Act of the Parliament of India where "she/her" pronouns were used unlike the usual "he/him" pronouns.

Timeline

* 18 November 2022: The

Ministry of Electronics and Information Technology The Ministry of Electronics and Information Technology (MEITy) is an executive agency of the Government of India, Union Government of the India, Republic of India. It was carved out of the Ministry of Communications and Information Technology (I ...

released the ''Digital Personal Data Protection Bill, 2022'' for public consultation. * 5 July 2023: The cabinet approved the ''Digital Personal Data Protection Bill, 2023'' which was the revised version of the 2022 bill. * 3 August 2023: ''Digital Personal Data Protection Bill, 2023'' was introduced in

Lok Sabha The Lok Sabha, also known as the House of the People, is the lower house of Parliament of India which is Bicameralism, bicameral, where the upper house is Rajya Sabha. Member of Parliament, Lok Sabha, Members of the Lok Sabha are elected by a ...

, the lower house of the

. * 7 August 2023: ''Digital Personal Data Protection Bill, 2023'' was passed by

. * 9 August 2023: ''Digital Personal Data Protection Bill, 2023'' was introduced and passed by

Rajya Sabha Rajya Sabha (Council of States) is the upper house of the Parliament of India and functions as the institutional representation of India’s federal units — the states and union territories.https://rajyasabha.nic.in/ It is a key component o ...

, the upper house of the Parliament of India. * 11 August 2023:

President of India The president of India (ISO 15919, ISO: ) is the head of state of the Republic of India. The president is the nominal head of the executive, the first citizen of the country, and the commander-in-chief, supreme commander of the Indian Armed ...

gave assent to the ''Digital Personal Data Protection Bill, 2023'' which made it the ''Digital Personal Data Protection Act, 2023''.

Background

* On 24 August 2017, the

Supreme Court of India The Supreme Court of India is the supreme judiciary of India, judicial authority and the supreme court, highest court of the Republic of India. It is the final Appellate court, court of appeal for all civil and criminal cases in India. It also ...

gave the

Right to Privacy verdict ''Justice K.S. Puttaswamy () vs. Union of India '' (2017), commonly known as the Right to Privacy verdict, was a List of landmark court decisions in India, landmark decision of the Supreme Court of India, which held that the right to privacy ...

. In the case of '' Justice K. S. Puttaswamy (Retd.) and Anr. vs Union Of India And Ors.,'' the Supreme court held that the Right to Privacy is a

fundamental right Fundamental rights are a group of rights that have been recognized by a high degree of protection from encroachment. These rights are specifically identified in a constitution, or have been found under due process of law. The United Nations' Susta ...

protected under Article 21 and Part III of the

Indian Constitution The Constitution of India is the supreme legal document of India, and the longest written national constitution in the world. The document lays down the framework that demarcates fundamental political code, structure, procedures, powers, and ...

. * After the verdict the

Government of India The Government of India (ISO 15919, ISO: Bhārata Sarakāra, legally the Union Government or Union of India or the Central Government) is the national authority of the Republic of India, located in South Asia, consisting of States and union t ...

has set up a data protection framework which started taking steps towards the creation of the data protection legislation after the

's privacy verdict. * On 22 December 2018, the constitution of committee of experts to deliberate on a data protection framework for India takes place by the chairmanship of Justice B.N. Srikrishna. * After the Government of India has constituted an expert committee under, the committee has sought public consultation on various white papers on data protection framework for India. * The Personal Data Protection Bill, 2018 draft was released. * The committee of experts under chairmanship of Justice B.N. Srikrishna has released their Data Protection Committee report. * On 14 August 2018, the Ministry of Electronics and Information Technology sought feedback on the Draft Personal Data Protection Bill. * On 4 December 2019, after further deliberations the Bill was approved by the cabinet ministry of

India India, officially the Republic of India, is a country in South Asia. It is the List of countries and dependencies by area, seventh-largest country by area; the List of countries by population (United Nations), most populous country since ...

. * On 11 December 2019, the Personal Data Protection Bill, 2019 was tabled in

. * On 11 December 2019, the Personal Data Protection Bill, 2019 was referred to the Joint Parliamentary Committee. * On 16 December 2021, the standing committee has submitted its report on the bill. * On 3 August 2022, the Personal Data Protection Bill, 2019 was withdrawn. * On 18 November 2022, the

released the draft legislation of the data protection framework for public consultation. * On 3 August 2023, the Digital Personal Data Protection Bill, 2023 was introduced in the Lok Sabha

Personal Data Protection Bill, 2019

The

set up a committee to study issues related to data protection. The committee was chaired by retired

Supreme Court In most legal jurisdictions, a supreme court, also known as a court of last resort, apex court, high (or final) court of appeal, and court of final appeal, is the highest court within the hierarchy of courts. Broadly speaking, the decisions of ...

judge Justice

B. N. Srikrishna Bellur Narayanaswamy Srikrishna (born 21 May 1941) is an Indian jurist and a retired judge of the Supreme Court of India. From 1993 to 1998, he headed the "Srikrishna Commission" that investigated causes and apportioned blame for the Bombay ri ...

. The committee submitted the draft version of Personal Data Protection in July 2018. The report was later modified several times by the

and, after receiving the approval of central cabinet, the draft legislation was tabled in the Parliament of India on 11 December 2019.

As bill

The Bill aims to: It provided for extensive provisions around collection of consent, assessment of datasets, data flows and transfers of personal data, including to third countries and other aspects around anonymized and non-personal data.

Criticism and withdrawal

The revised 2019 Bill was criticized by Justice

, the drafter of the original Bill, as having the ability to turn India into an " Orwellian State". In an interview with Economic Times, Srikrishna said that, "The government can at any time access private data or government agency data on grounds of sovereignty or public order. This has dangerous implications.” The role of social media intermediaries is being regulated more tightly on several fronts. The

Wikimedia Foundation The Wikimedia Foundation, Inc. (WMF) is an American 501(c)(3) nonprofit organization headquartered in San Francisco, California, and registered there as foundation (United States law), a charitable foundation. It is the host of Wikipedia, th ...

is hoping that the PDP bill will prove the lesser evil compared with the Draft Information Technology ntermediary Guidelines (Amendment) Rules2018.

Forbes India ''Forbes India'' is the Indian edition of ''Forbes'', which is managed by the Reliance Industries-owned media conglomerate, Network 18. History and profile Since its founding in 2008, ''Forbes India'' has achieved a circulation of 50,000 copies ...

reports that "there are concerns that the Bill gives the government blanket powers to access citizens' data." The bill after being tabled was referred to the JPC which was chaired by

Meenakshi Lekhi Meenakshi Lekhi (born 30 April 1967) is an Indian politician who served as the Minister of State for External Affairs and Culture of India from 7 July 2021 till 10 June 2024. She was a Member of Parliament from New Delhi Parliamentary cons ...

. After it received criticism from stakeholders, opposition and experts the bill was withdrawn from the

on 3 August 2022.

Digital Personal Data Protection Bill, 2023

Aim

Source: The Digital Personal Data Protection Bill, 2023 is the draft version of the Digital Personal Data Protection Act, 2023, initially the government has released its the Digital Personal Data Protection Bill, 2022 on 18 November 2022 for public consultation till 2 January 2023 and approved the revised version of the earlier draft which was released for public consultation making it the Digital Personal Data Protection Bill, 2023.

Timeline, introduction and passage

* On 18 November 2022, the Digital Personal Data Protection Bill, 2022 was released for public consultation, the deadline for receiving comments was 17 December 2022 * On 17 December 2022, the

has extended the deadline for receiving public comments till 2 January 2023 * On 5 July 2023, the cabinet has approved the Digital Personal Data Protection Bill, 2023 which is the revised version of the bill which was put up for public consultation earlier. * On 3 August 2023, the revised version of the Digital Personal Data Protection Bill, 2022 which is the Digital Personal Data Protection Bill, 2023 was introduced by

Ashwini Vaishnaw Ashwini Vaishnaw (born 18 July 1970) is an Indian politician, former Indian Administrative Service, IAS officer and a businessman serving as the 39th Minister of Railways (India), Minister of Railways, the 35th Ministry of Information and Broad ...

, Minister of Electronics and Information Technology in

. * On 7 August 2023, the bill was passed by

. The bill was then introduced and passed in the upper house of the Indian Parliament Rajya Sabha on 9 August 2023. * On 11 August 2023,

Draupadi Murmu Droupadi Murmu (born Durgi Biranchi Tudu; 20 June 1958) is an Indian politician who has been serving as the president of India since 2022. She won the 2022 presidential election as the Bharatiya Janata Party (BJP) candidate. She is the first ...

has given assent to the Digital Personal Data Protection Bill, 2023 which made it the Digital Personal Data Protection Act, 2023.

Overview

The Act protects digital personal data (that is, the data by which a person may be identified) by providing for the following *The obligations of Data Fiduciaries (that is, persons, companies and government entities who process data) for data processing (that is, collection, storage or any other operation on personal data) *The rights and duties of Data Principals (that is, the person to whom the data relates) *Financial penalties for breach of rights, duties and obligations *Establishment of Data Protection Board of India

Comparison with GDPR

The Digital Personal Data Protection Act, 2023 (DPDPA) and the European Union's General Data Protection Regulation (GDPR) share similar principles but differ in key aspects. The DPDPA-2023 applies only to digital personal data, while GDPR covers all forms of personal data. Unlike GDPR, DPDPA-2023 does not distinguish between personal and sensitive personal data. Both laws grant similar rights to individuals but differ in their approach to legal bases for data processing.

Data Protection Board of India

Under section 18 of the Digital Personal Data Protection Act, 2023, the Data Protection Board of India, an adjudicating body, will be established. The Minister of Electronics and Information Technology

and the then MoS Rajeev Chandrasekhar stated in press that the

Central government A central government is the government that is a controlling power over a unitary state. Another distinct but sovereign political entity is a federal government, which may have distinct powers at various levels of government, authorized or deleg ...

is setting up the Data Protection Board of India which will be an adjudicating body. It is a body that adjudicates the dispute between those whose personal data has been given to a platform and the platform which has in turn breached the obligations under the law.

Rights and provisions

*Right to access personal data *Right to correction and erasure of data *Right to revoke consent *Special provisions for the protection of data related minors (under 18 children) *Minimum penalty for breach is 50 crore INR *The terms and conditions and information related to collection of data should be made available in all the 22 languages in the 8th schedule of the Indian constitution *Right to grievance redressal *Right to nominate a consent manager to manage their data related requests on behalf of a data principal (The right to nominate a person to exercise rights in case of death or incapacity) *The Act does not permit processing which is detrimental to well-being of children or involves their tracking, behavioral monitoring or targeted advertising

Exemptions

The Act has made exemptions from the regulations related to the Act, they are: * The processing of personal data is necessary for enforcing any legal right or claim * The processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function * Personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India * Personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India * The processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force * The processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.

Criticism

Non-applicability to offline personal data

The Act is only applicable to the data collected digitally and when offline data gets digitized. Not having the applicability on offline personal data was criticized as there is no framework on how such data is handled.

Notes

References

{{Reflist Data laws of Asia Privacy legislation Acts of the Parliament of India 2023