DIGITAL PRIVACY GETS LEGAL BOOST

India's Digital Personal Data Protection Act (2023) balances privacy with business needs, creating new roles like Consent Managers to empower users.

- 

The Digital Personal Data Protection Act, 2023, enacted on August 11, 2023, governs the processing of digital personal data in India. It balances individuals' rights to data privacy with the legitimate need for businesses and the state to process personal data. Its scope includes:

Processing digital personal data within India.

Overseas processing connected to goods or services for individuals in India.

Exemptions for purely domestic or publicly available personal data.

The Act operationalizes these principles through a Data Protection Board and related enforcement mechanisms.

Appointment Process of Data Protection Board

A Search-cum-Selection Committee recommends candidates for the Chairperson and members. The committee includes:

• The Cabinet Secretary as chair.

• The Secretary of MeitY (Ministry of Electronics and Information Technology).

• The Secretary of the Department of Legal Affairs.

• Two subject matter experts.

Key Components of the Act and Rules

1. Rights and Duties of Data Principals

Individuals, termed as Data Principals, are granted rights such as:

• Access to Information: Data Fiduciaries must provide details on personal data processing.

• Correction and Erasure: Individuals can request updates or deletion of their data.

• Withdrawal of Consent: Similar ease as granting consent is mandated for withdrawal.

• Grievance Redressal: Mechanisms to file complaints against non-compliance. In turn, Data Principals are expected to provide authentic information, avoid frivolous grievances, and adhere to legal processes.

2. Obligations of Data Fiduciaries

Organizations handling data, referred to as Data Fiduciaries, must:

• Obtain clear and informed consent.