Active internet user’s in India exceed 760 million which makes the country the second-largest internet market globally. Before 2022, India never constituted any detailed privacy law to be followed by organizations. The Supreme Court of India acknowledged the right to privacy in the verdict of 2017. Later by August 2023, the Digital Personal Data Protection (DPDP) Act was passed by the Indian Parliament.

The DPDP Bill's introduction was established in 2022, and by August 2023, the bill was amended and passed by both houses of the Indian parliament. However, the provision has not yet been brought into execution. The Indian DPDP Act resembles the European Union’s General Data Protection Regulation (GDPR) even though it differs in concerns about the exemptions and gaps.

This article provides a comprehensive view of the Digital Personal Data Protection Act involving the consumer's and organizations' responsibilities, penalties, and evolutions it brings with the implementation.

The Digital Personal Data Protection Act 2023, is a beacon in India’s journey to securing data with sturdy data privacy regulations. The act is introduced to steer the wheel in the right direction concerning the management of digitized personal data, conferring roadblocks and opportunities for enterprises functioning within its authority.

The digital sphere in India is expanding widely, leading to the Digital Personal Data Protection Act implementation to ensure the privacy and security of each individual's data. The Act focuses on the legislative and regulatory steps implemented to secure people's data.

The Act emphasizes structured regulations for accumulating, processing, storing, and exchanging personal data by entities within India. The DPDP Act is India’s most sophisticated attempt to develop a detailed data privacy law following India’s Personal Data Protection Bill (PDPB) Vill 2022, which was part of a group of legislation comprising the National IT Governance Framework Policy and a new Digital India Act.

The PDPB 2022 focuses on “rendering the processing of digital personal data in a structured mode that identifies the right of individuals to secure their data and necessity to process personal data for lawful causes”, as per the draft legislation.

Following the Right to Privacy verdict in 2017 by the Supreme Court of India, the Indian government generated draft legislation formulated to safeguard the privacy of Indians. The initial conduction of the Personal Data Protection Bill acquired consequential review and eventually failed, inclusive of the Data Protection Bill 2021, which held some resemblance to the European Union’s General Data Protection Regulation but the DPB was abolished in August 2022.

On November 18, 2022, the Ministry of Electronics and Information Technology proposed the Digital Personal Data Protection Bill 2022 slated to replace some parts of existing law (Section 43A of the IT Act) and the SPDI Rules.

The Digital Personal Data Protection Act attains immense vitality as a legislative step focused on protecting individual privacy rights. There have been 81 amendments in the DPDP Bill after its introduction that have resulted in a comprehensive revision to its current existence. Key provisions and terms of the DPDP Act, 2023 are the following:

The DPDP Act allocates limitations on the organization processing personal data, consisting of:

In addition to the above obligations, organizations that process data can take the following steps to help them better prepare for compliance:

The DPDP Act defines a personal data breach as “any unauthorized processing of personal data or disclosure of data by error, acquisition, sharing, changes, damage or losing the access to personal data that expose the confidential information, integrity, and accessibility of personal data.”

Violation of the regulations by the DPDP Act could result in millions of losses, imposing fines of up to 250 crore INR/$30 million. Hence, it is essential to extract the risk of data breach. However, the penalty is comparatively less stringent than 2022’s legislation, which implied a fine of up to nearly INR 500 crore (approx $61 million).

The Act mentions penalties for different types of infringements or violations.

The DPDP Act resembles the EU’s GDPR, marking its stance globally on data security.

The DPDP Act marks an exceptional approach concerning data protection compared to the 2018 and 2019 draft bills established in the Parliament. The shift came into exposure in the November 2022 draft bill and has been enhanced in the 2023 law.

The Data Protection Board is responsible for managing and enacting the DPDP Act, but the Central Government holds the major authority. The Act clarifies the nature and incidents required for data principles to register complaints about the processing of personal data breaches, how it should be managed, and the person authorized to handle and penalties to impose on the violations committed.

The DPDP Act is a pinnacle of debate and contemplation exceeding five years of discussion. It establishes its mark as a firm stand on personal data protection regulation. These regulatory developments and the establishment of new Acts to protect the data will shape the structure of personal data privacy and the level of protection delivered in the coming years.

The attempts made by the government to ensure data privacy protection in the country are commendable, considering their pace to match with the evolving data breaches rising at a higher rate. The government is altering its approach according to data privacy as the evolved measures of data breaches are identified. However, the existing version of the law imposes fewer fines compared to the initial version, concluding it is a positive sign.

A noteworthy ratio of voluntary power is endowed with the central government, stating a lot is on the government’s plate to ensure how finely the government is focused and bound to data privacy.