Key Concepts of the Digital Personal Data Protection Act (DPDP Act), 2023

Introduction

Scope and Applicability

• The processing of digital personal data within India, regardless of whether the processing takes place in India or not.
• Data processed outside India if it involves offering goods or services to individuals in India.

Foundational Concepts

• Personal Data: This is the central subject matter of the Act. It is defined as “any data about an individual who is identifiable by or in relation to such data.” This broad definition covers any information that can directly or indirectly identify a person, whether online or offline, as long as it is in digital form or digitised subsequently.The Act applies to the processing of digital personal data within India and, under certain conditions, to processing outside India if it involves offering goods or services to Data Principals in India.
• Processing: The Act defines processing comprehensively as “an operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.” Essentially, any action taken with digital personal data falls under this definition.

Key Players Under the DPDP Act

• Data Principal: This is the individual to whom the personal data relates. The Act is designed to protect the rights of the Data Principal. They are the owners of their personal data and have specific rights granted under the Act.
• Data Fiduciary: This is the entity (person, company, firm, state, etc.) who “determines the purpose and means of processing of personal data.” The Data Fiduciary is the primary duty-holder under the Act, responsible for complying with its provisions regarding the personal data they process. Think of them as the decision-makers regarding why and how data is processed.
• Data Processor: This is an entity that “processes personal data on behalf of a Data Fiduciary.” Data Processors act under the instructions of the Data Fiduciary. While the primary obligations lie with the Data Fiduciary, the Act also imposes certain duties on Data Processors, particularly regarding security safeguards.
• Significant Data Fiduciary: The Central Government may notify certain Data Fiduciaries as ‘Significant Data Fiduciaries’ based on factors such as the volume and sensitivity of personal data processed, the risk of harm to the Data Principal, and the potential impact on the sovereignty and integrity of India. Significant Data Fiduciaries have additional obligations, including appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

Principles of Data Processing

• Consent: A cornerstone of the Act. Personal data can generally only be processed for a lawful purpose after obtaining the consent of the Data Principal. Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. The Data Principal has the right to withdraw consent at any time.
• Lawful Purpose: Processing must be for a purpose that is not prohibited by law. The purpose for which data is collected must be clearly stated to the Data Principal.
• Legitimate Uses: The Act also permits processing of personal data without consent in certain specified circumstances, referred to as “legitimate uses.” These include processing for purposes such as:
  • For the performance of any function under any law or for the exercise of any sovereign function.
  • For the performance by the State or any of its instrumentalities of any function under any law.

Obligations of Data Fiduciaries

• Notice: Data Fiduciaries must provide a clear and itemised notice to the Data Principal before or at the time of requesting consent. This notice must inform the Data Principal about the personal data to be collected, the purpose of processing, and how they can exercise their rights.
• Security Safeguards: Data Fiduciaries must implement reasonable security safeguards to prevent personal data breaches. This includes technical and organisational measures.
• Data Breach Notification: In the event of a personal data breach, the Data Fiduciary must notify the Data Protection Board of India and affected Data Principals in a timely manner. A “personal data breach” is defined as any unauthorised processing of personal data that compromises its confidentiality, integrity, or availability.
• Grievance Redressal Mechanism: Data Fiduciaries must establish a mechanism for the redressal of grievances of Data Principals.

Rights of Data Principals

• Right to Access Information: The right to obtain from the Data Fiduciary a summary of personal data being processed, the processing activities, and the identities of the Data Fiduciary and Data Processors.
• Right to Correction and Erasure: The right to seek correction, completion, updating, and erasure of their personal data.
• Right to Grievance Redressal: The right to a readily available grievance redressal mechanism provided by the Data Fiduciary.
• Right to Nominate: The right to nominate another person who shall exercise their rights under the Act in the event of their death or incapacity.

Cross-Border Data Transfers

Exemptions under the Act

• Processing of personal data for preventing and investigating any offence.
• Processing necessary for enforcing any legal right or claim.
• Processing by the State or its instrumentalities for matters related to the security of the State, public order, or preventing incitement to commit any cognizable offence relating to the sovereignty and integrity of India.
• Processing of personal data that is necessary for research, archiving, or statistical purposes, provided the data is not used to take any decision specific to a Data Principal and is processed in accordance with prescribed standards.

Enforcement and Penalties

Conclusion