Q. Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
UPSC Mains 2024 GS3 Paper
Model Answer:
The Digital Personal Data Protection (DPDP) Act, 2023 is a landmark legislation aimed at safeguarding citizens’ digital privacy while enabling legitimate, secure data processing.
1. Context of the DPDP Act, 2023
- Constitutional Mandate: Enacted to fulfill the Justice K.S. Puttaswamy Judgment (2017), which recognized the Right to Privacy as a fundamental right (Article 21).
- Expert Recommendations: Built upon the comprehensive data governance framework proposed by the Justice B.N. Srikrishna Committee (2018).
- Cyber Security Paradigm: Rapid digital penetration (Digital India) necessitated statutory defenses against corporate data breaches, cybercrimes, and unauthorized profiling.
2. Salient Features of the Act
- Extraterritorial Applicability: Covers digital personal data processed in India and abroad, if offering goods or services to Indian consumers.
- Data Fiduciary Obligations: Mandates strict consent-based processing, purpose limitation, data minimization, and immediate breach notifications.
- Data Principal Rights: Grants individuals the explicit right to access, correct, update, and erase their personal data.
- Institutional Mechanism: Establishes the independent Data Protection Board of India (DPBI) to direct compliance and adjudicate disputes.
- Stringent Penalties: Imposes heavy financial fines (up to ₹250 crore) for severe data breaches, enhancing deterrence.
- Cross-Border Transfers: Permits data flow to international jurisdictions unless explicitly blacklisted by the Central Government.
The DPDP Act, 2023 establishes a robust cyber-legal architecture, striking a crucial balance between securing individual privacy rights and fostering India’s digital innovation mandate.
