Digital Personal Data Protection (DPDP) Act

The Act defines Personal Data as any data that can identify an individual. This includes not only obvious identifiers like name and address but also online identifiers like IP addresses and location data. This broad definition ensures that a wide range of digital information is protected under the law.

A Data Fiduciary is any entity that determines the purpose and means of processing personal data. This could be a company, a government agency, or even an individual. The Act places significant obligations on Data Fiduciaries, including implementing security safeguards and providing individuals with access to their data.

The Act introduces the concept of a Data Processor, which is an entity that processes data on behalf of a Data Fiduciary. For example, a cloud service provider that stores data for a company would be considered a Data Processor. Data Processors also have obligations under the Act, although these are generally less extensive than those of Data Fiduciaries.

Consent is a crucial element. Data Fiduciaries must obtain explicit consent from individuals before processing their personal data, except in certain limited circumstances. This consent must be freely given, specific, informed, and unambiguous. For example, a website cannot bury a consent clause in its terms of service; it must obtain clear and affirmative consent from the user.

The Act allows for certain Legitimate Uses of data without consent, such as for legal compliance, medical emergencies, or providing services requested by the individual. However, these exceptions are narrowly defined and must be necessary and proportionate to the purpose. For instance, a hospital can process a patient's data without consent in an emergency situation, but it cannot use that data for marketing purposes without consent.

Individuals have the right to Access, Correction, and Erasure of their personal data. This means they can request a copy of their data, ask for it to be corrected if it is inaccurate, and ask for it to be erased if it is no longer needed. This empowers individuals to control their digital footprint.

The Act establishes a Data Protection Board of India to oversee enforcement and adjudicate disputes. The Board has the power to investigate complaints, impose penalties, and issue directions to Data Fiduciaries. This provides a mechanism for individuals to seek redress if their rights are violated.

The Act imposes significant Penalties for non-compliance, ranging from monetary fines to imprisonment. The severity of the penalty depends on the nature and extent of the violation. This creates a strong incentive for Data Fiduciaries to comply with the law.

The Act addresses Cross-Border Data Transfers, allowing data to be transferred outside India except to countries that are specifically restricted by the government. This aims to balance the need for data localization with the need for businesses to operate globally.

For children (defined as individuals under 18), the Act requires Data Fiduciaries to obtain verifiable parental consent before processing their personal data. This is a stricter standard than for adults and reflects the greater vulnerability of children. This is why the Karnataka government is considering restrictions on mobile phone use for children under 16, as it relates to data collection by social media companies.

The Act mandates Data Breach Notification. Data Fiduciaries must notify the Data Protection Board and affected individuals of any data breach that is likely to cause harm. This allows individuals to take steps to protect themselves from potential harm, such as identity theft.

The Act includes provisions for Voluntary Undertakings, where Data Fiduciaries can commit to specific actions to address non-compliance. This provides a more flexible and collaborative approach to enforcement, allowing Data Fiduciaries to rectify issues without facing penalties.

The Act distinguishes between Significant Data Fiduciaries and other Data Fiduciaries, with Significant Data Fiduciaries facing stricter obligations due to the volume and sensitivity of the data they process. The government will determine the criteria for designating an entity as a Significant Data Fiduciary.

The Act provides for the establishment of Grievance Redressal Mechanisms within Data Fiduciaries to handle complaints from individuals. This ensures that individuals have a first point of contact for resolving issues related to their data.

The Act promotes Data Minimization, requiring Data Fiduciaries to collect only the personal data that is necessary for the specified purpose. This reduces the risk of data breaches and misuse.