Q. Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

Model Answer:

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 is a landmark legislation aimed at safeguarding the digital personal data of Indian citizens. It responds to the urgent need for robust data protection in India’s expanding digital economy, replacing the withdrawn Personal Data Protection Bill, 2019.

Key features of the Act include:

1. Scope: It covers digital personal data processing within India and outside India if it involves profiling Indian citizens or offering them goods or services.

2. Data Fiduciary and Principal: The Act introduces these concepts, clearly defining roles and responsibilities of entities processing data and individuals whose data is processed.

3. Consent Mechanism: Data collection requires clear, precise, and easily understandable terms. Data principals have the right to withdraw consent.

4. Purpose Limitation: Data fiduciaries must limit collection to specified, lawful purposes and delete data once the purpose is fulfilled.

5. Data Protection Obligations: Fiduciaries must implement reasonable security safeguards and notify authorities and principals of data breaches.

6. Rights of Data Principals: Individuals are granted rights to access information, correction, erasure, and nomination of another person to exercise these rights in case of death or incapacity.

7. Data Protection Board: An independent body is established to enforce compliance and impose penalties for violations.

The Act balances data protection with innovation, addressing unique challenges in the Indian digital landscape while aligning with global standards.

Conclusion: The Act marks a crucial step towards ensuring data privacy in India’s digital age, aiming to protect individual rights while fostering innovation and economic growth.