Unleashing Power of Data

52 | Unleashing Power of Data [ DECODING “THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 ] HISTORY AND INTRODUCTION OF THE “THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023” India did not have a stand-alone personal data protection law to protect personal data and information shared or received in a verbal or written or electronic form. Though, protections were available, they were contained in a mix of statutes, rules and guidelines till the passage of “The Digital Personal Data Protection Act, 2023” The most prominent provisions were contained in the Information Technology Act, 2000 (as amended by the Information Technology Amendment Act, 2008) read with the Information Technology [Reasonable Security Practices and Procedures And Sensitive Personal Data Or Information] Rules, 2011 (SPDI Rules) As more data usage and data flows evolved, the conversation started on how citizens’ data can be protected through a dedicated legislation. In 2019, data protection bill was introduced in the parliament. After a series of events, in 2023, the final lawwas enacted by Indian parliament. FEATURES AND HIGHLIGHTS OF THE “THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023” The DPDP Act protects personal and sensitive data. The Act is unique in the fact that it makes no distinction on the various categories of data that are present. All the personal data is protected under this law. All needs valid informed consent. The Bill is based on seven principles of consent, data minimisation, accuracy, storage limitation, security, limitation, and accountability. The Bill provides rights to the individuals including right to access information about personal data processed, right to correction and erasure of data, right to grievance redressal and the right to nominate a person to exercise rights in case of death or incapacity. The regulator has no rule in making powers, apart from enforcement and passing penalties. Breaches must be notified to all individuals thereby effected. Dun & Bradstreet