Sentinel of privacy

‘The Digital Personal Data Protection Act, 2023, balances privacy rights with lawful data processing—establishing regulations for consent, security, and erasure while addressing modern challenges in India’s digital and Al-driven era

- RAAVI BIRBAL

The Digital Personal T Data Protection (DPDP) Act, 2023, yet to be implemented, is a statute designed for the digital age. Once its provisions come into effect, the DPDP Act will replace Section 43A of the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data of Information) Rules, 2011.

The statute regulates the processing of digital personal data in a way that balances individuals' right to protect their personal data with the need for lawful data processing and matters connected therewith or incidental thereto.

By prioritising privacy and security, the DPDP Act seeks to establish a framework that inter alia addresses the challenges of data handling in the modern digital age. It grants data principals those whose data is stored-specific data privacy rights, which data fiduciaries, or entities storing data, must respect. Under the Act, data fiduciaries may process personal data only in accordance with its provisions and for lawful purposes for which the data principal has given consent or for certain legitimate uses. Non-compliance by data fiduciaries may result in penalties.