(GIST OF YOJANA) The digital personal data protection act, 2023

(September-2023)

The digital personal data protection act, 2023

The Act provides for the processing of digital personal data in a manner that recognises both the rights of individuals to protect their personal data and the need to process such personal data for lawful purposes, and for matters connected therewith or incidental thereto.

The Act protects digital personal data (that is, the data by which a person may be identified) by providing for the following:

The obligations of Data Fiduciaries (that is, persons, companies, and government entities who process data) for data processing (that is, collection, storage, or any other operation on personal data);
The rights and duties of Data Principals (that is, the person to whom the data relates); and
Financial penalties for breaches of rights, duties, and obligations.

The Act also seeks to achieve the following:

Introduce data protection law with minimum disruption while ensuring necessary change in the way Data Fiduciaries process data;
enhance the ease of Living and the ease of Doing Business; and
enable India’s digital economy and its innovation ecosystem.

The Act is based on the following seven principles:

The principle of consented, lawful, and transparent use of personal data;
The principle of purpose limitation (use of personal data only for the purpose specified at the time of obtaining consent from the Data Principal);
The principle of data minimization (collection of only as much personal data as is necessary to serve the specified purpose);
The principle of data accuracy (ensuring
data is correct and updated);
The principle of storage limitation (storing data only until it is needed for the specified purpose);
The principle of reasonable security safeguards; and
The principle of accountability (through adjudication of data breaches and breaches of the provisions of the Act and imposition of penalties for the breaches).

The Act has few other innovative features:

The Act is concise and SArAL, that is, Simple, Accessible, rational & Actionable Law as it—

Uses plain language;
Contains illustrations that make the meaning clear;
Contains no provisos (“Provided that…”); and
Has minimal cross referencing.

By using the word ‘she’ instead of ‘he’, for the first time it acknowledges women in Parliamentary law-making.

The Act provides for following rights to the individuals:

The right to access information about personal data processed;
The right to correction and erasure of data;
The right to grievance redressal; and
The right to nominate a person to exercise rights in case of death or incapacity.

The Act provides for following obligations on the data fiduciary:

To have security safeguards to prevent personal data breach;
To intimate personal data breaches to the affected Data Principal and the Data Protection Board;
To erase personal data when it is no longer needed for the specified purpose;
To erase personal data upon withdrawal of consent;
To have in place grievance redressal system and an officer to respond to queries from Data Principals; and
To fulfill certain additional obligations in respect of Data Fiduciaries notified as Significant Data Fiduciaries, such as appointing a data auditor and conducting periodic Data Protection Impact Assessment to ensure higher degree of data protection.

The Act safeguards the personal data of children also,

The Act allows a Data Fiduciary to process the personal data of children only with parental consent.
The Act does not permit processing which is detrimental to well-being of children or involves their tracking, behavioural monitoring or targeted advertising.