Deciphering the Digital Personal Data Protection Act (DPDPA) 2023 in India: A comprehensive guide
The DPDP Bill 2022 officially became the Digital Personal Data Protection Act after receiving the President's assent on August 11, 2023 (official Gazette notification by the Government of India DPDP Act). The DPDPA, in conjunction with the Digital India Bill and the draft Indian Telecommunication Bill 2022, will serve as a strong foothold to address the governance of personal data in India.
This Act is responsible for regulating the processing of digital personal data in India, regardless of whether the data was initially collected in digital or non-digital form and later digitized.
Additionally, it's important to mention that the DPDP Act will have an impact on India's trade negotiations with other nations. It is at par with the international laws for data protection, such as the Global Data Protection Regulation (GDPR) of the European Union.
Applicability of the DPDP Act 2023
At its core, the DPDP Act has a fundamental goal of establishing a heightened level of accountability and responsibility for entities operating within India, which includes internet companies, mobile apps, and businesses engaged in collecting, storing, and processing citizens' data.
Emphasizing the importance of the "Right to Privacy," this legislation aims to ensure that these entities operate with transparency and are held accountable for their actions in handling personal data, thereby prioritizing the privacy and data protection rights of Indian citizens.
The DPDP Act's reach extends beyond India's borders, encompassing digital personal data processing activities conducted abroad pertaining to individuals in India.
Data fiduciary
Data Fiduciary means any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.
The data fiduciary is responsible for managing and processing the data, while the data principal is the individual whose data is being collected and protected.
Obligations of a data fiduciary
- A person can only use a Data Principal's personal data in accordance with this Act and for a lawful reason, either:
- With the Data Principal's consent, or
- For specific legitimate purposes.
- In this context, "lawful purpose" means any purpose that is not explicitly prohibited by law.
- Whenever a Data Fiduciary requests consent from a Data Principal, they must provide the Data Principal with a notice that:
- Explains the personal data being collected and the purpose of its use,
- Describes how the Data Principal can exercise their rights, and
- Informs the Data Principal of the procedure for making a complaint to the Board, following the prescribed guidelines.
- A significant Data Fiduciary must appoint a Data Protection Officer (DPO) based in India, who is responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary.
Who is a Significant Data Fiduciary?
The three main obligations of a Significant Data Fiduciary are:
- Appoint a Data Protection Officer (DPO) based in India and is directly answerable to the Board of Directors or a similar governing body.
- Appoint an Independent Data Auditor to evaluate compliance
- Conduct Data Protection Impact Assessment (DPIA) & periodic audits
Data Principal
Data Principal means the individual to whom the personal data relates and where such individual is:
(i) a child, includes the parents or lawful guardian of such a child;
(ii) a person with a disability, including her lawful guardian, acting on her behalf.
Rights of a Data Principal
The Data Principal has the following rights:
- A Data Principal has the right to request certain information from a Data Fiduciary to whom they have previously given consent. To do so, they can make a request following the prescribed procedure. The information they can request includes:
- A summary of their personal data being processed by the Data Fiduciary and the activities related to processing that data.
- The names of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by the Data Fiduciary, along with a description of the shared personal data.
- Any other information related to their personal data and its processing, as prescribed by law.
- Clauses (b) and (c) of subsection (1) do not apply to the sharing of personal data by the Data Fiduciary with another Data Fiduciary authorized by law to obtain such data. This sharing can occur when the other Data Fiduciary requests it in writing for purposes such as preventing or investigating offenses or cyber incidents or for prosecuting or punishing offenses.
- A Data Principal also has the right to request corrections, completions, updates, or erasure of their personal data for which they have given consent. This should be done following the procedures and requirements of applicable laws.
- When a Data Principal requests correction, completion, or updating of their personal data, the Data Fiduciary should:
- Correct any inaccurate or misleading personal data.
- Complete any incomplete personal data.
- Update the personal data.
- A Data Principal can request the erasure of their personal data following the prescribed procedure. Upon receiving such a request, the Data Fiduciary should erase the personal data unless it is necessary to retain it for the specified purpose or to comply with applicable law
- A Data Principal has the right to access grievance redressal mechanisms provided by a Data Fiduciary or Consent Manager for any actions or omissions related to the handling of their personal data or the exercise of their rights under this Act and its rules.
- The Data Fiduciary or Consent Manager must provide readily available means for grievance redressal regarding their obligations in relation to the Data Principal's personal data and the exercise of the Data Principal's rights under this Act and its rules.
Duties of Data Principal
The rights of a Data Principal don't come without the balancing share of duties, A Data Principal must do the following:
- Follow all current applicable laws when exercising rights under this Act.
- Do not pretend to be someone else when providing personal data for a specific purpose.
- Not withhold important information when providing personal data for official documents like IDs or proof of address issued by the government.
- Not file false or frivolous complaints with a Data Fiduciary or the Board.
- Provide only information that can be proven as genuine when exercising the right to correction or erasure under this Act or its rules.
What are the rules for notice under DPDPA 2023?
Under the Data Protection and Privacy Regulations (DPDPA), "notice" refers to the obligation of a data fiduciary to provide clear and transparent information to the data principal about how their data will be used, the purposes of processing, the categories of data collected, the retention period, and the rights of the data principal, among other things.
This notice is typically conveyed through privacy policies, consent forms, or other means to ensure that individuals are informed about the handling of their personal data, enabling them to make informed decisions about their data privacy.
Notice should be:
- Clear: Notices should be clear and easy to understand.
- Specific: Information should be itemized for clarity.
- Simple: Use plain language that is easily comprehensible.
- With apt language choice: Data subjects should have the option to access information in either English or any of the 22 languages mentioned in the Eighth Schedule of the Indian Constitution.
The notice should contain:
- Clarity of information: The notice accompanying a consent request should provide the data subject with details about the personal data that will be processed and the specific purpose for which it will be processed.
- Rights awareness: The notice should also explain how the data subject can exercise their rights as outlined in the DPDPA.
- Complaint procedure: Additionally, it should describe the procedure for the data subject to lodge a complaint with the Board.
What are the rules regarding consent under DPDPA 2023?
Consent under DPDPA refers to the voluntary, informed, specific, and revocable agreement given by individuals for their personal data to be collected and processed by an entity or organization. It must be freely given, and data fiduciaries must maintain records of consent.
Consent should have:
- Freedom: Consent should be freely given, devoid of any coercion or pressure.
- No conditions: It should not be contingent upon any other factors, such as receiving a product or service.
- Clarity: Consent should be clear and leave no room for ambiguity regarding its purpose.
- Specificity: The consent should specify the exact reason for data collection and processing.
- Informed decision: Data subjects should receive sufficient information about data usage to make an informed choice regarding consent.
- Understandable: Consent should be presented in plain, official Indian language, ensuring it is easy for individuals to comprehend.
What are the duties and responsibilities of a consent manager?
Consent Manager means a person registered with the Board who acts as
a single point of contact to enable a Data Principal to give, manage, review, and
withdraw her consent through an accessible, transparent, and interoperable platform.
The decision to appoint a consent manager for a company depends on the company's specific situation and the type of data processing it engages in. However, as a general guideline, it is advisable for companies to designate a consent manager to ensure adherence to India's DPDPA.
Some common questions for organizations wanting to comply with DPDP Act 2023
1. Can you transfer data across borders? Instead of whitelisting the countries or territories where the data can be transferred, the DPDPA provides that the Central Government of India can blacklist or restrict the transfer of data to the specified countries or territories.
2. What should you do in case of a data breach? If a Personal Data Breach occurs, the Data Fiduciary must notify both the Board and every impacted Data Principal about the breach. The Act prescribes the form in which the Data Fiduciaries must inform about the breach. However, the DPDPA does not specify a timeline within which the breach must be reported.
3. What are the penalties for non-compliance with the DPDPA?
The Data Protection Board (DPB) is responsible for the enforcement of the DPDPA, including non-compliance, levying penalties, and issuing directions and mediations (to resolve disputes between parties) to ensure compliance with the law. The DPB is appointed by the Central Government and consists of a chairperson and other members.
Take proactive steps to ensure DPDPA compliance with Scrut. Review your data practices, update privacy policies, and train your team. Safeguard your business and customer data today.
Related Posts
Ready to see what security-first GRC really looks like?
Ready to see what security-first GRC really looks like?
Ready to see what security-first GRC really looks like?
See what a real security- first GRC platform looks like
Ready to see what security-first GRC really looks like?
Focus on the traveler experience. We’ll handle the regulations.
Achieve and maintain compliance without the busywork.
Choose risk-first compliance that’s always on, built for you, and never in your way.
Ready to see what security-first GRC
One platform, every framework. No more duplicate work.
You can’t manage user access if you’re always playing catch-up.
Explore the future of enterprise GRC
Tired of chasing vendors for risk assessments?
Join the thousands of companies automating their compliance with Scrut.
The right partner makes all the difference. Let’s grow together.
Make your business easy to trust, put security transparency front and center.
Risk-first security starts with risk-first visibility.
Secure your team from the inside out.
Don't settle for slow, expensive compliance. Get Scrut instead.
Risk-first compliance for forward-thinking teams.
Audits without the back-and-forth. Just seamless collaboration.
Scale fast. Stay compliant. Automate the rest.
Compliance? Done and dusted, in half the time.
Get ahead of GDPR compliance before it becomes a problem.
Outgrowing table-stakes compliance? Create custom frameworks with ease.
Navigate SOC 2 compliance, minus the stress.
PCI DSS compliance, minus the panic.
Take the wheel of your HIPAA certification journey today.
We’ve got what you need to fast-track your ISO 27001 certification.
Make your NIST AI RMF journey as smooth as possible.
Your GRC team, multiplied and AI-backed.
Modern compliance for the evolving education landscape.
Ready to simplify healthcare compliance?
Don’t let compliance turn into a bottleneck in your SaaS growth.
Find the right compliance frameworks for your business in minutes
Ready to see what security-first GRC really looks like?
Real-time visibility into every asset
Ready to simplify fintech compliance?
The Scrut Platform helps you move fast, stay compliant, and build securely from the start.
Scrut helps you set up a security program that scales with your business and stands up to audits. Without last-minute chaos.
Scrut helps you streamline audits, close deals faster, and stay ahead of risk without slowing down your team. Because trust shouldn’t take months to earn.
Scrut helps you set up a security program that scales with your business and stands up to audits. Without last-minute chaos.
Tag, classify, and monitor assets in real time—without the manual overhead.
Whether you're entering new markets or launching new products, Scrut helps you stay compliant without slowing down.
Scrut pulls compliance data straight from the tools you already use—so you don’t have to dig for evidence, chase approvals, or manually track controls.
Less manual work, more customizability. The Scrut Platform gives you everything you need to align your compliance to your business’s priorities.
With Scrut, you’re not just adding a tool to your offering—you’re adding a competitive edge. Join our Partner Network and help your clients streamline their GRC program.
Gaining trust is your first step to growing and cracking better deals. The Scrut Platform comes pre-built with all the tools you need to showcase a firm security posture and build confidence.
Don’t settle for rigid systems—Scrut ensures your risk management strategy is as flexible as your business needs.
Start building a security-first culture. Save your operations from improper training and a lack of compliance awareness.
Scrut fast-tracks compliance so you can focus on scaling, not scrambling. Automate compliance tasks and accelerate enterprise deals—without the grind.
Automate assessments, track compliance, and get full visibility into third-party risk—all in one place.
Scrut automates compliance tasks, supports proactive risk management, and saves you time, so you can focus on growing your business. Start building trust with customers and scaling confidently.
Leave legacy GRC behind. Meet the AI-powered platform built for teams managing risk and compliance in real time.
Give auditors direct access, keep track of every request, and manage audits effortlessly—all in one place.
Scrut ensures access permissions are correct, up-to-date, and fully compliant.
Whether you need fast results or a fully tailored program mapped to your risks and needs, Scrut delivers exactly what you need, when you need it. Ready to start?
Scrut unifies compliance across all your frameworks, so you can stop juggling systems and start scaling securely.
Manually managing your compliance processes and audits can get inefficient and overwhelming. Scrut automates these outdated, manual processes and eliminates your last-minute worries.
Access automated compliance, real-time risk tracking, and expert-backed support—all in one platform. Get started with Scrut!
Less manual work, more customizability. The Scrut Platform gives you everything you need to align your compliance to your business’s priorities.
The Scrut Platform helps you move fast, stay compliant, and build securely from the start.
Earn trust and back it up with solid evidence. Scrut takes you through the SOC 2 compliance journey step-by-step, navigating every complexity you face.
Manage your PCI DSS compliance with real-time monitoring and effortless automation. Get started with Scrut today!
Securing your PHI shouldn’t be a constant hassle. Scrut automates your workflows—from risk assessments to monitoring—so you can put your compliance worries on the back burner.
Automate security controls, simplify audits, and keep your ISMS aligned with the latest standards. Get started with Scrut!
Tackle potential AI risks with NIST AI RMF-compliant controls and get expert support every step of the way.
Offload the grunt compliance work to us. Execute manual, draining GRC tasks with the reliable AI-powered Scrut Teammates without switching contexts or bottlenecks.
Whether you're managing student data, partnering with educational institute, or expanding to new geographies—Scrut gives you the tools to stay compliant, manage risk, and build trust at every step.
Scaling healthcare doesn’t have to come at the cost of security. Scrut keeps your organization compliant, audit-ready, and protected—no matter how fast you grow.
Scrut automates the hard parts of compliance and security so you can move fast and stay ahead of risks from day one.
The Scrut Platform helps you move fast, stay compliant, and build securely from the start.
Growth in fintech comes with heavy scrutiny. Scrut helps you stay compliant, audit-ready, and secure—without slowing down your momentum.
