Q.Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

Body

A. Context of the Digital Personal Data Protection Act, 2023

• Surge in Digital Activity: With India witnessing an exponential rise in internet penetration and digital transactions, massive volumes of personal data are continuously collected and processed by both private corporations and government agencies.
• Global Data Protection Trends: The Act aligns India's data governance regime with international benchmarks, such as the European Union’s General Data Protection Regulation (GDPR), emphasizing individual privacy rights.
• Public Demand for Privacy: Escalating incidents of data breaches, identity theft, and unauthorized surveillance created strong public demand for robust statutory privacy protections.
• Preceding Legal Frameworks: Prior to this Act, India relied on the outdated Information Technology Act, 2000, which lacked comprehensive, dedicated provisions for personal data protection, leaving a significant legislative gap.

B. Salient Features of the Act

• Definition of Personal Data: Broadly defines personal data as any information that can identify an individual, including sensitive financial, health, and biometric details.
• Rights of Data Principals: Grants individuals (Data Principals) critical rights, including:
  • Right to access information about their processed data.
  • Right to correction and erasure of inaccurate or obsolete data.
  • Right to grievance redressal and the right to nominate a representative in case of death or incapacity.
• Consent Mechanism: Mandates that data processing must be based on explicit, specific, informed, unconditional, and revocable consent.
• Responsibilities of Data Fiduciaries: Entities processing data (Data Fiduciaries) must implement robust security safeguards, ensure data accuracy, and adhere to principles of data minimization and purpose limitation.
• Data Protection Board of India (DPBI): Establishes an independent adjudicating body to monitor compliance, address grievances, and penalize violations.
• Cross-Border Data Transfer: Regulates the transfer of personal data outside India, permitting transfers only to countries or territories approved by the central government.
• Provisions for Children's Data: Restricts the processing of children's data, requiring verifiable parental consent and prohibiting targeted advertising or tracking of minors.
• Penalties for Non-Compliance: Prescribes severe financial penalties, ranging up to ₹250 crores for major data breaches and systemic non-compliance.

---