Data Protection Compliance

In August 2023, India passed the Digital Personal Data Protection (DPDP) Act, 2023, marking a significant development in the country’s data protection landscape. This Act is the first cross-sectoral law on personal data protection in India, enacted after extensive deliberations. Here’s a brief note on the key aspects
of Data Protection Compliances under the DPDP Act:

The Act emphasizes the right of individuals to protect their personal data and balances this with the need to process personal data for lawful purposes¹.

The DPDP Act applies across various sectors, impacting a wide range of businesses and
services¹.

It replaces Section 43A of the Information Technology Act, 2000, and the Information
Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011².

The Act outlines principles for the processing of digital personal data, ensuring that such processing is fair, transparent, and respects the privacy of individuals¹.

Entities that determine the purpose and means of processing personal data (data fiduciaries) and those that process data on behalf of fiduciaries (data processors) have specific obligations under the Act¹.

The Act requires data fiduciaries to obtain consent from individuals and provide notice regarding the processing of their personal data¹.

Individuals, referred to as data principals, are granted rights concerning their personal data, including the right to access, correction, and erasure¹.

The Act provides for the establishment of a Data Protection Authority to oversee and enforce data protection laws¹.

The Act specifies penalties for non-compliance, ensuring that stakeholders adhere to the data protection standards set forth¹.

The Act includes provisions for the transfer of personal data outside India, subject to certain conditions¹.

The DPDP Act, 2023, is a landmark legislation that aims to protect personal data while also facilitating its lawful processing. It is a significant step towards aligning India’s data protection framework with global standards. For a detailed understanding of the Act and its implications, it is advisable to consult the full text of the law and seek professional advice. If you need more detailed information or assistance, please let me know!