The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive data protection law governing how personal data is collected, stored, and processed. It establishes a rights-based, consent-driven framework that puts individuals (Data Principals) at the center of the digital ecosystem.
This article breaks down the Act in a clear, structured, and practical way — ideal for compliance teams, policy professionals, and businesses preparing for implementation.
What Is the DPDP Act, 2023?
The DPDP Act was introduced following the Justice K.S. Puttaswamy (2017) judgment that recognized privacy as a fundamental right. Amid rising data breaches and rapid digitization, the Act replaces outdated provisions under the IT Act, 2000 and creates a modern privacy framework aligned with global standards.
Key Definitions Under the DPDP Act, 2023
Personal Data
Any data that can directly or indirectly identify an individual, including:
- name, phone number, Aadhaar
- financial information
- health details
- location data
- online behavior such as search history or app usage
Data Principal
The individual whose data is being collected.
Includes:
- adults
- parents/guardians (when the data principal is a child)
- authorized guardians for persons with disability
Consent Manager
A government-registered platform that enables individuals to:
- give consent
- withdraw consent
- manage permissions across companies
This ensures transparent and centralized consent management.
Data Fiduciary
Any organization that determines the purpose and means of processing personal data.
Examples:
- banks
- online platforms
- hospitals
- insurers
- government departments
They hold primary responsibility for compliance.
Significant Data Fiduciary (SDF)
Large or high-impact entities that handle:
- sensitive data
- large-scale user bases
- critical operations
Extra obligations apply, such as:
- appointing a DPO based in India
- periodic data audits
- Data Protection Impact Assessments (DPIA)
Data Processor
Entities that process personal data on behalf of a Data Fiduciary, such as:
- cloud service providers
- call centers
- SMS/email vendors
The Data Fiduciary remains accountable for their actions.
Specified Purpose
Data can only be collected for a clear, legitimate, and communicated purpose, such as:
- delivering a service
- verifying identity
- providing a product
Data cannot be repurposed without fresh consent.
Personal Data Breach
Unauthorized:
- access
- disclosure
- modification
- loss
- misuse of personal data
Organizations must notify both:
- the affected Data Principal
- the Data Protection Board
Applicability of the DPDP Act, 2023
The Act applies to:
- all digital personal data processed within India
- data collected offline but later digitized
- entities outside India offering goods/services to individuals in India
This means global platforms like Netflix, Meta, or Amazon must comply.
Exemptions Under the Act
The Act does not apply to:
- personal/domestic use (e.g., a family WhatsApp group)
- publicly available information
- government-notified exemptions (for specific agencies)
Responsibilities of Data Fiduciaries
Data Fiduciaries must:
1. Collect data with valid consent
Consent must be:
- free
- informed
- specific
- unambiguous
- revocable
Exceptions include “legitimate use” cases such as:
- state subsidies
- emergencies
- legal obligations
- employment-related uses
2. Provide clear notices
Notices must be available in English and any language from the Eighth Schedule.
3. Maintain data accuracy
Especially for data used for decision-making (e.g., credit scoring, medical decisions).
4. Implement strong security safeguards
5. Delete data after the purpose is fulfilled
6. Notify breaches quickly
7. Provide accessible grievance redressal
Publish contact details of a DPO or authorized officer.
Additional Obligations for Significant Data Fiduciaries (SDFs)
SDFs must:
- Appoint a Data Protection Officer (DPO) in India
- Conduct Data Protection Impact Assessments (DPIA)
- Undergo independent data audits
- File regular compliance reports
These requirements ensure accountability for high-risk data handlers.
Rights of Data Principals (Individuals)
1. Right to Information
What data is collected, why, and how it is used.
2. Right to Consent & Withdrawal
Consent must be as easy to withdraw as to give.
3. Right to Correction & Erasure
Individuals can request:
- correction
- updating
- completion
- deletion of personal data
4. Right to Grievance Redressal
5. Right to Nominate
A nominee can act on their behalf in case of death or incapacity.
Duties of Data Principals
The Act also expects responsible use from individuals, such as:
- not submitting false complaints
- providing accurate information
- complying with lawful requests
Special Provisions for Children
For individuals under 18 years, companies must:
- obtain verifiable parental/guardian consent
- avoid behavioral monitoring
- avoid targeted advertising
- avoid tracking/profiling
Future exemptions may apply for safe educational platforms.
Data Protection Board of India (DPBI)
The DPBI is the central regulatory authority responsible for:
- managing complaints
- conducting inquiries
- imposing penalties
- issuing binding directions
It operates digitally and functions like a quasi-judicial body with civil court powers.
Penalties Under the DPDP Act, 2023
Penalties are financial only (no criminal punishment for companies).
Penalty Range: ₹10,000 to ₹250 crore
Examples:
- Breach of basic fiduciary duties → up to ₹200 crore
- Violations involving children’s data → up to ₹200 crore
- Failure of SDFs to meet extra obligations → up to ₹250 crore
- False information, obstruction → ₹10,000–₹50,000
The DPDP Act’s penalty structure is among the strongest globally, in some cases exceeding GDPR.
Penalties apply to the organization, not individuals — unless there is intentional misconduct.
Conclusion
The DPDP Act, 2023 heralds a new era of privacy protection and digital trust in India. It creates a robust, consent-first framework that balances:
- individual rights
- business responsibilities
- innovation-friendly policies
The Act’s success will hinge on:
- proactive compliance
- strong governance
- user awareness
- industry adoption
India is now positioned to emerge as a trusted global digital economy with privacy at its core.
Frequently Asked Questions (FAQs)
1. Who does the DPDP Act apply to?
All organizations processing digital personal data of individuals in India.
2. What is a Data Fiduciary?
An entity that determines how and why personal data is processed.
3. What is a Significant Data Fiduciary (SDF)?
Large data-handling organizations required to meet additional compliance obligations.
4. Does the DPDP Act apply to companies outside India?
Yes — if they offer goods/services to people in India.
5. What are the biggest penalties under the Act?
Up to ₹250 crore for SDF violations.
6. Is DPDP Act 2023 similar to GDPR?
It is inspired by GDPR but more compact and adapted to India’s digital ecosystem.
Leave a Reply