Key Compliance Requirements under the Digital Personal Data Protection (DPDP) Act, 2023
Introduction
The Digital Personal Data Protection (DPDP) Act, 2023, represents a paradigm shift in how digital personal data is processed in India. Unlike previous light-touch regulation, the DPDP Act introduces a comprehensive framework establishing rights for individuals ('Data Principals') and obligations on entities that decide the purpose and means of data processing ('Data Fiduciaries').
Key Concepts of the Act
- Data Principal: The individual to whom the personal data relates.
- Data Fiduciary: Any person or entity who determines the purpose and means of processing personal data.
- Consent Managers: Entities registered with the Data Protection Board that enable Data Principals to give, manage, review, and withdraw consent.
Core Obligations for Businesses (Data Fiduciaries)
- Notice & Consent: Data must be processed only for a lawful purpose with the explicit consent of the individual. Every request for consent must be accompanied or preceded by a clear notice detailing what data is being collected and why.
- Accuracy & Security: Businesses must ensure that processed data is accurate and secure. They must implement reasonable security safeguards to prevent data breaches.
- Breach Notification: In the event of a personal data breach, the Data Fiduciary must notify both the Data Protection Board of India (DPBI) and the affected Data Principals in the prescribed manner.
- Data Erasure: Data must be erased once the purpose for which it was collected has been served, or when the individual withdraws consent.
Rights of the Data Principal
Under the DPDP Act, individuals have the right to:
- Obtain details of what personal data is being processed.
- Seek correction, completion, or erasure of their personal data.
- Register grievances with the Data Fiduciary or file a complaint with the DPBI.
- Nominate another individual to exercise their rights in case of death or incapacity.
Financial Penalties
Non-compliance can lead to heavy penalties, up to ₹250 crores for failure to prevent data breaches or failure to notify the Board and individuals of a breach. Consequently, businesses operating in India must proactively review their data practices, update privacy policies, and establish robust consent management workflows.