Digital Personal Data Protection Act, 2023
An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
TaxByKK · Laws by Sector · taxbykk.com
Index of provisions · 9 chapters, 44 sections
Chapter I Preliminary3 sections
Chapter II Obligations of Data Fiduciary7 sections
Chapter III Rights and Duties of Data Principal5 sections
Chapter IV Special Provisions2 sections
Chapter V Data Protection Board of India9 sections
- 18Establishment of Board
- 19Composition and qualifications for appointment of Chairperson and members
- 20Salary, allowances payable to and term of office
- 21Disqualifications for appointment and continuation as Chairperson and Members of Board
- 22Resignation by Members and filling of vacancy
- 23Proceedings of Board
- 24Officers and employees of Board
- 25Members and officers to be public servants
- 26Powers of Chairperson
Chapter VI Powers, Functions and Procedure to Be Followed by Board2 sections
Chapter VII Appeal and Alternate Dispute Resolution4 sections
Chapter VIII Penalties and Adjudication2 sections
Chapter IX Miscellaneous10 sections
- 35Protection of action taken in good faith
- 36Power to call for information
- 37Power of Central Government to issue directions
- 38Consistency with other laws
- 39Bar of jurisdiction
- 40Power to make rules
- 41Laying of rules and certain notification
- 42Power to amend Schedule
- 43Power to remove difficulties
- 44Amendments to certain Acts
Schedules
- The Schedule
About this Act
The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) sets the rules for processing digital personal data in India. It balances the individual's right to protect personal data against the need to process that data for lawful purposes.
The Act sets up the Data Protection Board of India to inquire into breaches and impose penalties. Appeals against the Board's orders go to the Appellate Tribunal.
Its 44 sections are arranged in nine chapters: obligations of Data Fiduciaries, rights and duties of Data Principals, special provisions on cross-border processing and exemptions, the Board, appeals and alternate dispute resolution, and penalties. Penalty amounts are set out in the Schedule.
Who it applies to
- Data Fiduciaries, that is, organisations that decide the purpose and means of processing digital personal data
- Significant Data Fiduciaries notified by the Central Government, which carry additional obligations
- Data Processors acting on behalf of Data Fiduciaries
- Data Principals (the individuals whose data is processed), including parents and guardians of children
- Consent managers and entities processing data of persons in India from outside India
Good to know
- Key chapters
- Chapter II (obligations of Data Fiduciary, sections 4 to 10), Chapter III (rights and duties of Data Principal, sections 11 to 15) and Chapter V (Data Protection Board of India, sections 18 to 26).
- Penalties
- Section 33 links penalties to the Schedule; sums realised are credited to the Consolidated Fund of India under section 34.
Frequently asked questions
Which section of the DPDP Act deals with consent?
Section 6. Notice to the Data Principal is covered in section 5.
Which section covers processing of children's personal data?
Section 9.
Where is the right to correction and erasure of personal data?
Section 12.
Which section allows transfer of personal data outside India?
Section 16.
Which section establishes the Data Protection Board of India?
Section 18.