When did the Digital Personal Data Protection Act, 2023 come into effect?

It came into effect on 1st September 2023.

What are the key provisions of the DPDP Act, 2023?

The Act includes data protection rights, consent for data usage, data localisation, and the establishment of the Data Protection Board of India.

Who does the DPDP Act apply to?

It applies to data collected in India and data processed outside India if it concerns goods or services provided to people in India.

What is the Data Protection Board of India (DPBI)?

It is the regulatory authority set up to handle grievances, monitor non-compliance, and impose penalties under the DPDP Act.

Home

Schemes

Services

Community

About Us

Government’s Initiative To Protect And Regulate Data: What Is Digital Personal Data Protection Act, 2023?

Q: What is the Digital Personal Data Protection Act, 2023?

It is a law introduced to protect personal data and privacy, ensuring individuals have control over their digital information.

Samridhi

Author

Updated: 28-01-2025 at 6:50 AM

Government’s Initiative To Protect And Regulate Data: What Is Digital Personal Data Protection Act, 2023?

Data and Internet has become the new fuel and it has revolutionised the way we live our lives. With the help of collected data, different services are advertised to us and our data is also used to process various information in companies.

However, recently many concerns have erupted over the unauthorised use of data by entities. To avert this and provide individuals with data protection rights, the government of India introduced the Digital Personal Data Protection Act, 2023. Let us learn about this Act in Detail.

What Is The Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 or DPDP Act was brought into effect on September 1, 2023, by the government of India. The Act addresses the need for data security and data protection. It confers multiple rights upon individuals that save them from harm or losses due to data privacy violations.

It applies to data that has been collected online and offline, which may have later been digitised. It also applies to processing digital personal data outside the territory of India, if it involves providing goods or services to the data principals within the territory of India.

The Justice BN Srikrishna Committee report brought about the drafting and application of this legal and legislative framework. It highlights the need for data regulation and data privacy regulation in a highly modernised and digital age.

What Are The Salient Provisions Of The Digital Personal Data Protection Act, 2023?

The DPDP Act of 2023 is a breakthrough legislation that solves multiple concerns. Its salient provisions and features are:

Right To Data Protection: It gives individuals the right to know and control their personal data. This includes rights to access, correction, and erasure of their data, giving citizens greater control over their personal information.
Data Processing and Consent: Consent of the user needs to be taken by companies before using their data and information as the DPDP Act mandates consent now.
Data Localisation: The Act says that sensitive personal data will be stored and processed within India. This provision will enhance data security and facilitate easier enforcement of data protection laws.
Regulatory Authority: The Act establishes a Data Protection Board of India (DPBI) for grievance redressal purposes.
Data Breach Notification: Organisations are required to notify individuals and the Data Protection Board of any data breaches that may compromise personal information. This provision aims to ensure transparency and prompt action in the event of data leaks.
Fines and Penalties: The Act provides stringent penalties in events of data breaches or unauthorised use of data. Any data privacy violation could cost companies a fortune now.

What Are The Rights Conferred By The Digital Personal Data Protection Act, 2023?

While addressing the privacy and consent concerns of individuals or data principals (a person who owns the data or whose data it is), the Act confers certain rights upon its stakeholders. This gives the individuals a security and sense of guarantee. The rights given under the DPDP Act are:

Right to information: Seeking information about where the data is being used, and how it is being processed and used can be sought by data principals and individuals now.
Right to correction and erasure: Any data that has been uploaded by an individual can be corrected or removed by an individual as per their choice.
Right to grievance redressal: In events of data privacy violation, individuals will be able to raise concerns against the violators as there will be a grievance redressal mechanism in place.
Right to nominate any other person/family/relative in the event of the demise of the data principal.

What Is The Grievance Redressal Mechanism Under The Digital Personal Data Protection Act, 2023?

An elaborate grievance redressal mechanism has been set up under the DPDP Act which will ensure that complaints are dealt with properly. There is a hierarchy of authorities set in place to entertain grievances related to data protection and data privacy. The mechanism is:

A Data Protection Board of India has been set up which will act as an impartial adjudicatory body responsible for resolving data privacy-related grievances and disputes between relevant parties.
Recognising non-compliance through supervision and imposing penalties on offenders by the Data Protection Board of India.
The chief executive and board members of the Data Protection Board will be appointed by the Central Government.
An appeal against any order of the DPBI shall lie with the High Court. The High Court can also take suo-moto cognizance.

What Are The Penalties Under The Digital Personal Data Protection Act, 2023?

The penalties under the Digital Personal Data Protection Act, 2023 are not ‘criminal penalties’. They are mostly monetary/liquidated damages. The financial penalty could range from as high as Rs. 250 crores to a data fiduciary or data processor to as low as Rs.10000 to a data principal (the owner of data).

Apart from damages, the company may also be ruled to be out of operations by the Courts of law if found guilty to that extent.

Conclusion

Through the new data protection law, the government has solved many problems with a single arrow. The issue of consent while collecting data and unauthorised or malicious use of such data needed to be regulated and penalised, which is how this legislation came into place. With the progressive and insightful provisions, India will now be able to ensure data privacy for its citizenry.

For more information, grievances or queries, contact the Ministry of Electronics and Information Technology (MeitY) by calling +91-11-24365940 or by dropping a mail at gc-rtipgcell@meity.gov.in.

Have any query? Drop your questions or concerns on Jagruk Bharat community page!

Frequently Asked Questions