DPDP Act Explained: A Complete Guide to India's Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 (DPDPA) marks a transformative shift in India's data governance architecture. Replacing the outdated Section 43A of the Information Technology Act, 2000, the DPDP Act establishes an exhaustive legal framework governing the processing of digital personal data within India and extraterritorially where goods or services are offered to Indian data principals.
1. Scope and Territorial Applicability
The DPDP Act applies to the processing of digital personal data within the territory of India, whether collected online in digital form or collected offline and subsequently digitized. Crucially, under Section 3(b), the Act applies extraterritorially to processing outside India if such processing is in connection with any activity related to offering goods or services to Data Principals within India.
2. Key Definitions Under DPDP Act 2023
- Data Principal: The individual to whom the personal data relates, including children (under 18 years) and persons with disability through their lawful guardians.
- Data Fiduciary: Any person or legal entity who alone or in conjunction with others determines the purpose and means of processing personal data.
- Data Processor: Any entity that processes personal data on behalf of a Data Fiduciary pursuant to a valid data processing contract.
- Consent Manager: An interoperable platform registered with the Data Protection Board of India (DPBI) enabling individuals to give, manage, review, and withdraw consent.
- Significant Data Fiduciary (SDF): Entities classified by the Central Government based on the volume, sensitivity of data processed, risk of harm, national security, and public order.
3. Ground of Processing: Valid Consent & Certain Legitimate Uses
Under Section 6, personal data may only be processed for a lawful purpose for which the Data Principal has given valid consent, or for certain legitimate uses defined under Section 7 (such as employment purposes, medical emergencies, state benefits, or court orders).
Valid consent must be:
- Free, specific, informed, unconditional, and unambiguous with a clear affirmative action.
- Accompanied by or preceded by a notice in clear and plain language, available in English and all 22 languages specified in the Eighth Schedule to the Constitution of India.
- Easily withdrawable at any time with comparable ease to granting consent.
4. Obligations of Data Fiduciaries
Every Data Fiduciary is mandated to implement robust organizational, technical, and legal safeguards:
- Reasonable Security Safeguards: Implement technical controls (encryption at rest, TLS 1.3 in transit, role-based access control) to prevent personal data breaches under Section 8(5).
- Mandatory Breach Notification: In the event of a personal data breach, intimate the Data Protection Board of India (DPBI) and each affected Data Principal without delay.
- Data Erasure & Retention Limits: Erase personal data upon withdrawal of consent or as soon as the specified purpose is achieved, unless retention is necessary under statutory law.
- Effective Grievance Redressal: Provide an accessible, transparent mechanism for redressing grievances of Data Principals within prescribed timelines.
5. Rights of Data Principals
The Act grants enforceable rights to individuals over their personal data:
- Right to Access Information: Summary of personal data being processed, identities of other data fiduciaries/processors with whom data has been shared.
- Right to Correction & Erasure: Correction of inaccurate data, completion of incomplete data, updating, and erasure of personal data no longer necessary.
- Right of Grievance Redressal: Right to file complaints with the Data Fiduciary first, and escalate unresolved grievances to the Data Protection Board of India (DPBI).
- Right to Nominate: Nominate any individual who, in the event of death or incapacity of the Data Principal, shall exercise their privacy rights.
6. Heavy Statutory Penalties (Schedule to DPDP Act)
The DPDP Act imposes stringent financial penalties for non-compliance, adjudicated by the Data Protection Board of India:
| Non-Compliance / Breach | Maximum Penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent personal data breach | Up to ?250 Crore |
| Failure to notify DPBI and affected data principals of a data breach | Up to ?200 Crore |
| Breach in observance of additional obligations regarding children's data | Up to ?200 Crore |
| Breach of additional obligations by Significant Data Fiduciary (SDF) | Up to ?150 Crore |
| Breach of any other provision of the Act or Rules | Up to ?50 Crore |
7. How LLM Advocates Assists Organizations
At LLM Advocates, our certified privacy attorneys and ISO 27001/42001 Lead Auditors guide corporations, tech startups, and multinational enterprises through every stage of DPDP compliance:
- DPDP Gap Analysis and Comprehensive Privacy Audits.
- Drafting and localized translation of multilingual Section 5 Privacy Notices.
- Data Protection Officer (DPO) Advisory and Board Representation.
- Data Processing Agreements (DPAs) and Vendor Risk Assessments.
- Data Breach Incident Response Management and representation before the Data Protection Board of India (DPBI) and TDSAT.
