The Digital Personal Data Protection Bill, 2023 (DPDP Bill) has received approval from the President of India after being passed by both houses of parliament. The Rajya Sabha unanimously approved the bill on August 9, while the Lok Sabha passed it on August 7 through a voice vote despite opposition leaders’ objections.
The main objective of the DPDP legislation is to regulate the processing of digital personal data, striking a balance between individuals’ right to safeguard their data and the legitimate need to process such data for relevant purposes. It applies to digital personal data processing within India, covering both online and digitized offline data. It also extends to data processing outside India if Indian goods or services are offered.
The Act mandates obtaining consent for lawful data processing, with exceptions for voluntary sharing and state-related processing. Data fiduciaries are responsible for maintaining data accuracy, security, and deletion once its intended purpose is fulfilled. The law grants various rights to individuals, including access to information, correction and erasure of data, and seeking resolution for grievances.
Government agencies can be exempted from complying with the bill’s provisions under specific circumstances, such as safeguarding national security, maintaining public order, and preventing offenses. To ensure compliance, the Central government will establish the Data Protection Board of India to adjudicate cases of non-compliance.
Concerns have been raised about potential violations of the fundamental right to privacy due to exemptions granted for state data processing, especially concerning national security. These exemptions might lead to excessive data collection, processing, and retention.
Critics have noted that the law lacks regulation for addressing potential harms arising from personal data processing. Notably, the DPDP Bill is distinctive for using she/her pronouns while referring to all genders, which the “Interpretation” provision clarifies as being inclusive of all individuals regardless of gender. For notification see
