Digital Personal Data Protection Act (DPDP ACT) 2023, India’s Privacy Law

DPDP Act aims to transform how businesses manage, use, and protect personal data. India as a nation has advanced significantly in the age of digitization. The protection of people’s rights and privacy has always been India’s top priority for “Digital India” and its ultimate objective. Now that everything we do is digital, personal information has become a valuable commodity. 

According to IBM Security’s Cost of a Data Breach Report, the average cost of a data breach in India reached 17.9 crore in 2023, an all-time high and a nearly 28% rise from 2020. To prevent such breach instances, a turning point in Indian legislative history, the Digital Personal Data Protection Act 2023 came up. The DPDP Act’s background, purpose, importance of DPO, terminologies, main features, and effects on both organizations and individuals will all be covered comprehensively in this blog.

Background of the DPDP Act

The adoption of data privacy regulations in India has traditionally proven to be complicated. The Supreme Court’s decision regarding the Right to Privacy as a Fundamental Right marked the beginning of Digitally Secure India in 2017. India made a significant technological advance with the proposal and adoption of the Digital Personal Data Protection (DPDP) Bill in 2022. The Union Cabinet approved this significant bill on July 5, and it was introduced in the current Parliament session. This got underway on July 20, 2023. The procedure proceeded swiftly. 

The Lok Sabha approved a substantial law on August 7, which was further approved by the Rajya Sabha on August 9. The Government of India (GOI) has officially approved the DPDP Bill into law, according to its notification. The Digital Personal Data Protection Act, sometimes known as the DPDP Act, became operative on August 11, 2023.

Purpose of DPDP in 2023

The main objective of the DPDP Act is to ensure transparency, responsibility, and ethical use of personal data. It acknowledges the delicate balance between a person’s entitlement to data protection and the proper handling of that data for legal functions. The Act strives to provide organizations with simple guidelines and appropriate data processing procedures.

The DPDP Act aims to improve the standards for entities operating in India. These entities can be for instance online retailers, mobile app developers, and companies that handle personal data about residents. The legislation, which places a strong emphasis on the fundamental “Right to Privacy,” attempts to enforce open operations and hold these organizations responsible for the gathering, storing, and processing of personal data. It prioritizes protecting Indian citizens’ rights to privacy and data protection.

This act applies to the processing of personal data within the territory of India and outside India. It applies to the activity related to offering goods and services to Data principals within India. The DPDP Act enhances data protection for the personal information of Indian people managed outside of India. However, the act is not applicable for the processing of domestic or private purposes by individuals or for the personal data that is publicly available.

DPDP Act 2023: DPOs and the Regulatory Board

Data Protection Officers (DPOs) and the Data Protection Board play crucial roles in the complex framework of the Digital Personal Data Protection Act 2023.

Role of DPOs

Significant Data Fiduciaries (SDF), in particular, have been charged with considerable data management obligations, which is their role as DPOs. Every large data fiduciary must appoint a Data Protection Officer to ensure compliance with the DPDP Act. These DPOs serve as important liaisons, responding to questions and issues raised by data principals, promoting openness, and maintaining the accuracy of data handling procedures. They are essential in managing the intricacies of data amount and sensitivity, enabling global transfers, and ensuring smooth compliance.

Role of the Data Protection Board

The Data Protection Board which serves as an unbiased adjudicating body, is essential to the DPDP Act’s operation. This unbiased authority handles privacy-related complaints, evaluates instances of non-compliance, and applies penalties where necessary. The federal government carefully monitors all board appointments, including those of the chief executive and board members, to ensure a fair hiring procedure. To ensure accountability and due process within the framework of the DPDP Act’s regulatory framework, a legal body, presumably linked to the Telecom Disputes Settlement and Appeal Tribunal (TDSAT), offers a platform for users to dispute the Data Protection Board’s judgments.

Key Terminologies

• Digital Personal Data: Refers to any data about an individual that is identifiable, and processed digitally.
• Consent: Organizations should clearly and actively seek consent that is freely given, explicit, and informed. The content should represent the Data Principal’s desires.
• Data Protection Board of India: Regulatory body overseeing compliance, imposing penalties and addressing grievances.
• Notice: A notice should be concise, itemized, and stated in straightforward terms. According to the Eight Schedule of the Indian Constitution, Data Principals should have the option of accessing information in English or any of the 22 languages.
• Data Fiduciary: Any person who chooses the purpose and means of processing personal data either independently or in collaboration with others 
• Data Principal: An individual whose personal data is being processed.
• Exemptions: Specific cases where the rights of data principals and obligations of data fiduciaries do not apply, subject to government notifications.
• Penalties: Monetary fines imposed by the Data Protection Board for non-compliance with the DPDP Act 2023.

Key Features of the DPDP Act You Must Know

Let’s explore the main features of this groundbreaking law that will protect your business from serious setbacks and legal issues.

Strict Applicability:

DPDP Act 2023 applies to digital personal data collected online or digitized from offline sources within India. Compliance is necessary to process personal data for Indian clients outside of India, assuring global accountability.

Mandatory Consent:

Processing of personal data requires a legitimate reason and the subjects’ explicit consent. Serious fines may result from failure to get consent; withdrawal options are highlighted. For individuals below 18 years of age, consent will be provided by the parent or the legal guardian.

Rights and Duties:

Individuals (data principals) have the right to information, correction, erasure, and complaint resolution. Penalties for violation of obligations, like filing false complaints, may reach up to Rs 10,000.

Data Fiduciary and its Obligations:

Data fiduciaries are responsible for ensuring accurate data, strong cyber security measures, and quick breach reporting. Except in certain government circumstances, it’s important to erase data once its intended purpose has been fulfilled.

International Data Transfer:

The central government permits transfers of personal information, subject to regulations.

Exemptions and Penalties:

There are specific exceptions for the enforcement of legal rights and the prevention of offenses. Compliance is essential since there are severe penalties for violations that can range up to Rs 250 crore.

How do Organizations ensure Compliance?

Organizations must work together to navigate the DPDP’s difficulties. Here’s how they can maintain compliance:

Data Protection and Security: Put in place strong security measures to stop data breaches. Notify or alert individuals and authorities immediately in the event a breach occurs.

Transparent Consent Procedures: Obtain individuals’ explicit, informed consent before processing their data. Make sure that everyone is informed of the processes and interests involved.

Regular Training and Awareness: Provide workers with the information they need to know about the DPDP Act through in-depth training programs. Continuous awareness campaigns can be facilitated.

Effective Policy Management: It is important to maintain and centralize policies, distribute updates, and automate reminders to make sure staff members are aware of and follow the company’s data protection policies.

Conclusion

The Digital Personal Data Protection Act of 2023 has made it more important than ever for organizations in India to protect sensitive data. Besides being mandated by legislation, upholding the ideals of this act is also morally righteous, considering the importance of persons’ fundamental rights.

With its knowledge and cutting-edge solutions, Kratikal, being a CERT-In empanelled auditor is a leader in assisting businesses with achieving compliance and enhancing data security. Kratikal equips businesses to successfully negotiate the complexities of the DPDP Act by conducting thorough training programs and promoting awareness. We aim to offer cutting-edge policy management technologies. Through these measures, businesses can establish a strong data protection culture, encouraging trust and maintaining security in the advanced digital environment.

Ref: https://www.thehindubusinessline.com/info-tech/average-cost-of-data-breach-in-india-reaches-179-crore-in-2023-report/article67118990.ece

The post Digital Personal Data Protection Act (DPDP ACT) 2023, India’s Privacy Law appeared first on Kratikal Blogs.

*** This is a Security Bloggers Network syndicated blog from Kratikal Blogs authored by Riddika Grover. Read the original post at: https://kratikal.com/blog/digital-personal-data-protection-act-dpdp-act-2023-indias-privacy-law/