THE DIGITAL PERSONAL DATA PROTECTION ACT , 2023 BY YOGESH V NAYYAR LATEST EDITIO

The Digital Personal Data Protection Act, 2023, is India’s first comprehensive law focused on protecting digital personal data. It outlines obligations for entities handling personal data (Data Fiduciaries) and rights for individuals (Data Principals) regarding their data. The Act aims to balance individual privacy with the legitimate needs of businesses and the government. 

Here’s a breakdown of key aspects:

Purpose:

• • To regulate the processing of digital personal data, ensuring individuals have control over their data and that it is handled responsibly.

• To create a framework for data protection that balances individual rights with the need for data processing for lawful purposes. 

Key Features:

• Data Fiduciaries’ Obligations:

  Entities processing data must obtain consent, ensure data accuracy, implement security safeguards, and notify data breaches to the Data Protection Board of India and affected individuals. 

• Data Principals’ Rights:

  Individuals have the right to access, correct, and erase their personal data, the right to nominate a representative, and the right to file complaints with the Data Protection Board. 

• Consent Managers:

  The Act introduces the concept of Consent Managers, who act as intermediaries to help individuals manage their consent for data processing. 

• Significant Data Fiduciaries:

  The government can identify “Significant Data Fiduciaries” based on the volume and sensitivity of data processed, and these entities may have additional obligations. 

• Data Protection Board:

  A Data Protection Board is established to oversee the implementation of the Act, adjudicate on breaches, and impose penalties.