DPDP ACT 2023 (Syllabus: GS Paper 2 – Governance)

Context: Recently, with the government's enactment of the Digital Personal Data Protection (DPDP) Act 2023, a recent report reveals that nearly half of Indian organizations, both large and small, lack the necessary skill sets to effectively implement this legislation.

Digital Personal Data Protection Act 2023

• About: An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
• The Ministry of Electronics and Information Technology has been discussing digital personal data and its protection, culminating in the 'Digital Personal Data Protection Bill, 2023.'
• The Act aims to establish a framework for processing digital personal data that respects both individuals' rights to safeguard their data and the necessity of processing data for legitimate purposes.

Provisions of the Act

• Application: The Act is applicable when processing digital personal data within India, under the following circumstances: Data is collected online & Data is collected offline, and then digitized.

oIt also applies to the processing of personal data outside India if the purpose is to offer goods or services within India.

oPersonal data can only be processed for lawful purposes with the individual's consent.

• Consent: For individuals below 18 years of age, consent must be granted by a parent or legal guardian.
• Rights of Data Principal: A data principal, who is an individual undergoing data processing, possesses the following rights:

oThe right to obtain information regarding the processing of their data.

oThe right to request the correction and deletion of their personal data.

• Personal data beyond India: It permits the transmission of personal data beyond India, barring countries that have been prohibited by the central government through an official notification.