Digital Personal Data Protection Act (DPDPA), India

The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s data protection law governing personal data processing. It emphasizes consent, purpose limitation, data fiduciary obligations, and individual rights like access and correction. The Data Protection Board of India enforces compliance, with penalties for violations and exemptions for government processing.

The Digital Personal Data Protection (DPDP) Act, 2023 marks a significant milestone in India’s journey toward establishing a robust data protection regime. It is designed to safeguard the digital personal data of individuals while promoting transparency and accountability among organisations processing such data.

A key aspect of the DPDP Act is its strong enforcement mechanisms, which include substantial penalties for non-compliance. The Act empowers the Data Protection Board of India (DPBI) to investigate and adjudicate cases related to data protection violations.

Key Provisions

To mitigate risks and ensure accountability, the Act mandates organisations to:

Develop and maintain comprehensive data protection frameworks.
Implement robust security measures to safeguard personal data.
Fulfil obligations related to data subject rights and cross-border data transfers.
Designate a Data Protection Officer (DPO) for oversight in certain cases.

The DPDP Act not only places significant responsibilities on organisations but also provides individuals with tools to exercise greater control over their personal data.

By emphasizing privacy as a fundamental right, the DPDP Act aims to build trust in the digital ecosystem while balancing the needs of businesses and innovation.

Penalties for Non-Compliance

Up to ₹250 crore for failing to implement adequate security measures to prevent data breaches.
Up to ₹200 crore for violations such as processing personal data without valid consent.
Up to ₹50 crore for non-compliance with orders issued by the DPBI.
Daily fines for continuous contraventions, escalating the cost of non-compliance.

These penalties underscore the importance of adhering to the DPDP Act’s requirements, as even inadvertent lapses can lead to severe financial repercussions.

DPDPA Solutions

Advoke International provides comprehensive solutions tailored to support your organization in achieving full compliance with the DPDPA.

Frequently Answered Questions

Who does the DPDP Act apply to?

The Act applies to organizations operating within India and to entities outside India if they process personal data in connection with offering goods or services to individuals in India. It ensures that businesses, irrespective of location, adhere to the privacy principles set out in the Act when dealing with data from Indian citizens.

How does the DPDP Act impact businesses?

The DPDP Act requires businesses to adopt comprehensive data protection measures, update their policies, train employees, and ensure mechanisms for managing data subject rights and reporting data breaches. Non-compliance can lead to hefty fines, operational disruptions, and reputational harm, making adherence to the Act essential for long-term sustainability.

What rights do individuals have under the DPDP Act?

The Act empowers individuals, known as Data Principals, with a range of rights. These include:

Right of Access – The ability to request details from the data fiduciary regarding personal data, its processing, and any third parties with whom the data has been shared.
Right to Correction – The right to request corrections for inaccuracies, rectify omissions, or update personal data promptly, subject to certain exceptions.
Right to Erasure – The right to request deletion of personal data, including data processed by third-party data processors, within a reasonable timeframe, with some exceptions.
Right to Grievance Redressal – The right to a clear mechanism for lodging complaints, ensuring a response from the data fiduciary or consent manager within a reasonable period, with some exceptions.
Right to Nominate – The ability to appoint a representative to exercise rights under the Act on behalf of the data principal in cases of death or incapacity.

What are the penalties for non-compliance with the DPDP Act?

The Act imposes significant financial penalties for violations. Organizations may face fines of up to ₹250 crore for data breaches caused by inadequate security measures and up to ₹200 crore for processing personal data without valid consent. Repeated or continuous violations and non-compliance with DPBI orders can result in additional penalties, emphasizing the importance of strict adherence to the law.

Does the DPDP Act allow cross-border data transfers? Yes, cross-border data transfers are permitted under the Act but are restricted to countries or territories that the Indian government designates as having adequate data protection standards. This ensures that personal data remains protected even when processed outside India.