Model Answer
0 min readIntroduction
India lacked a comprehensive legislation to govern personal data protection, leaving citizens vulnerable to data breaches and misuse. While the Information Technology Act, 2000, addressed some aspects of data security, it proved inadequate in the face of evolving digital technologies and increasing data collection practices. Several attempts were made to enact a dedicated law, including the Personal Data Protection Bill, 2019, which faced significant opposition and revisions. Finally, the Digital Personal Data Protection Act, 2023 (DPDPA) was passed by Parliament, marking a significant step towards establishing a robust data protection framework in India. This Act aims to provide individuals with greater control over their personal data and establish accountability for organizations processing such data.
Context Leading to the DPDPA, 2023
The need for a dedicated data protection law arose from several factors:
- Increasing Digitalization: Rapid growth in digital transactions and online services led to massive data collection.
- Data Breaches: Frequent data breaches exposed sensitive personal information, raising privacy concerns.
- Global Standards: The European Union’s General Data Protection Regulation (GDPR) and other international frameworks set a precedent for comprehensive data protection.
- Puttaswamy Judgement (2017): The Supreme Court declared the right to privacy a fundamental right, necessitating a legal framework to protect personal data.
Salient Features of the Digital Personal Data Protection Act, 2023
1. Scope and Applicability
The Act applies to all processing of digital personal data within the territory of India. It covers both personal data collected online and offline, but only if it is digitized. It excludes personal data processed for journalistic, artistic, or research purposes.
2. Key Definitions
- Personal Data: Any data about an individual who is identified or identifiable.
- Data Principal: The individual whose personal data is being processed.
- Data Fiduciary: The entity determining the purpose and means of processing personal data (e.g., companies, organizations).
- Data Processor: The entity processing personal data on behalf of the Data Fiduciary.
3. Rights of Data Principals
The Act grants several rights to Data Principals, including:
- Right to Information: To obtain information about the processing of their personal data.
- Right to Correction and Erasure: To correct inaccurate data and request deletion of personal data.
- Right to Grievance Redressal: To seek redressal for violations of their rights.
- Right to Nominate: To nominate another individual to exercise their rights in case of death or incapacity.
4. Obligations of Data Fiduciaries
Data Fiduciaries are obligated to:
- Purpose Limitation: Process data only for specified, legitimate purposes.
- Data Minimization: Collect only necessary data.
- Data Accuracy: Ensure the accuracy of personal data.
- Data Security: Implement reasonable security safeguards to prevent data breaches.
- Notice and Consent: Provide clear and concise notice to Data Principals about data processing and obtain their consent where required.
5. Data Protection Board of India (DPBI)
The Act establishes the DPBI, an independent regulatory body responsible for:
- Enforcing the provisions of the Act.
- Investigating complaints and imposing penalties.
- Developing and promoting data protection awareness.
6. Cross-Border Data Transfer
The Act allows cross-border data transfer to countries deemed to provide an adequate level of data protection. The Central Government will notify such countries. Transfers to countries without adequate protection are permitted under specific conditions, such as contractual agreements.
7. Penalties
Violations of the Act can result in penalties of up to ₹250 crore.
Comparison with GDPR
| Feature | DPDPA, 2023 | GDPR |
|---|---|---|
| Consent | Consent is a key requirement, but the Act allows for processing without explicit consent under certain circumstances. | Requires explicit and unambiguous consent for most data processing activities. |
| Data Localization | Does not mandate strict data localization, but prioritizes processing within India. | Strong data localization requirements for certain types of data. |
| Penalties | Up to ₹250 crore. | Up to €20 million or 4% of global annual turnover, whichever is higher. |
Conclusion
The Digital Personal Data Protection Act, 2023, represents a significant advancement in India’s data protection landscape. By establishing a comprehensive framework for data processing, granting rights to data principals, and creating a regulatory body, the Act aims to foster trust in the digital economy and protect individual privacy. However, its effective implementation will depend on clear guidelines, robust enforcement mechanisms, and ongoing adaptation to evolving technological challenges. The Act’s success will also hinge on raising awareness among citizens and organizations about their rights and responsibilities under the new law.
Answer Length
This is a comprehensive model answer for learning purposes and may exceed the word limit. In the exam, always adhere to the prescribed word count.