"Parliament Passes New Bill on Digital Privacy"
In August 2023, the Indian Parliament enacted the Digital Personal Data Protection Act, 2023 (DPDPA), marking a significant milestone in the nation's journey towards comprehensive data privacy legislation. This Act establishes a legal framework governing the processing of digital personal data, aiming to balance individual privacy rights with the necessity of data processing for lawful purposesProvisions
-
Consent and Data Principal Rights: The Act mandates that personal data can only be processed with the explicit consent of the individual, referred to as the "Data Principal." Individuals are granted rights to access, correct, update, and erase their data. Additionally, they can nominate a representative to exercise these rights in case of death or incapacity
-
Obligations of Data Fiduciaries: Entities processing personal data, termed "Data Fiduciaries," are required to ensure transparency, data minimization, and implement reasonable security safeguards. They must also inform Data Principals about the purpose of data collection and obtain verifiable consent
-
Protection of Children's Data: Processing personal data of children under 18 years requires verifiable parental consent. The Act prohibits tracking, behavioral monitoring, or targeted advertising directed at children .
-
Cross-Border Data Transfers: The government is empowered to restrict the transfer of personal data to certain countries through notifications. Data Fiduciaries must comply with these restrictions when transferring data internationally
-
Establishment of Data Protection Board: The Act provides for the creation of the Data Protection Board of India, an adjudicatory body to address grievances and ensure compliance with the Act's provisions .