Update: the passage of the Digital Personal Data Protection Act of 2023

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

Update: the passage of the Digital Personal Data Protection Act of 2023

priyanshi

@priyanshi

September 1, 2023

Public Policy

341

On August 11, 2023, the Digital Personal Data Protection Act received presidential approval and notified in the Gazette. India now has a dedicated legal regime for personal data protection and has shifted away from the limited framework under section 43A of the IT Act. The objective of this law is to regulate the processing of digital personal data for lawful purposes while recognising individual rights.

This Act is the final version of the earlier draft Digital Personal Data Protection Bill that had been released in November 2022 on which we had submitted our feedback (see here). The final Act aligns with several of our suggestions including: (a) greater flexibility on the application of protections for children’s data, (b) removing default data localisation or mirroring requirements, (c) avoiding ‘whitelisting’ of countries.

The Act is available here. An overview of the Act is below.

Scope

The Act applies to personal data that is in digital form, or data that was collected non-digitally and has been digitised subsequently. It also applies to the processing of personal data outside India if that is related to any activity for providing goods and services in India.

The Act does not apply to personal data that is collected and processed for personal or domestic purposes or that is made publicly available either directly by the individual or by any other person who is doing so because of a legal obligation.

Key definitions

Personal Data: any data about an individual who is identifiable by or in relation to such data.

Processing: a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

Data Fiduciary: the person who decides the “purposes and means” of processing.

Data Processor: the person who carries out processing on behalf of the Data Fiduciary.

Data Principal: the individual to whom the personal data relates. In the case of children or persons with disability, their parents, or lawful guardians, respectively.

Obligations

The Act does not impose any direct obligations on Data Processors. Data Fiduciaries are primarily responsible for all processing undertaken by Data Processors on their behalf.

Personal data processing is allowed for lawful purposes, either through consent or certain legitimate purposes (outlined in section 7). When relying on consent, Data Fiduciaries must follow the obligations in sections 5 and 6 regarding notice and consent.

The Act recognises the concept of the Consent Manager to act on behalf of Data Principals. Consent Managers will be expected to register with the Data Protection Board set up under the Act.

Section 7 allows processing of personal data if it was provided voluntarily by the data principal without express revocation of consent, for employment purposes, medical emergencies, etc.

The Act also requires Data Fiduciaries to ensure, when certain conditions are met, that personal data is kept accurate and complete (accuracy principle) and erased (and no longer retained).

Data Fiduciaries are to ensure technical and organisational measures are in place to comply with the Act, and reasonable security safeguards are in place to prevent personal data breaches. Data Fiduciaries are also required to report breaches to the Board and affected individuals.

The processing of children’s personal data necessitates verifiable parental consent. The Act prohibits behavioural monitoring and targeted advertising. The Central Government has the power to exempt certain Data Fiduciaries from these obligations and has the power to notify a lowered age of consent for certain data fiduciary, that will be exempted from these obligations.

The Central Government may notify certain Data Fiduciaries as significant. These will then have to meet additional obligations, such as appointing a Data Protection Officer, conducting Data Protection Impact Assessments and periodic audits.

Rights and duties of data principals

The Act provides Data Principals the right to request information about their personal data, including its summary, processing activities, and all the Data Processors their personal data is shared with. They can also ask Data Fiduciaries to correct or delete their data and nominate someone to act on their behalf in case of death or incapacity.

Data Fiduciaries must provide accessible grievance redressal mechanisms for Data Principals. The Act emphasises that Data Principals should exhaust these options before approaching the Data Protection Board (“DPB”).

Data Principals have certain duties to provide verifiably authentic information when seeking data erasure, must not impersonate others or withhold information when applying for state documents or proofs, among others.

Restrictions on outbound transfers

Section 16 empowers the Central Government to restrict data transfers to specific countries as notified. Additionally, if any Indian law offers stronger safeguards or restrictions on personal data transfers by Data Fiduciaries outside India, such laws will take precedence.

Exemptions

The Central Government can exempt specific Data Fiduciaries from the Act, while retaining the obligation for reasonable security safeguards under section 17(1). This exemption applies to processing personal data of individuals outside India through contracts between an entity outside India with an entity in India, processing for crime prevention or law enforcement, and more.

The Act provides exemption to processing carried out in the interest of state sovereignty, security, by any notified state instrumentality or for research/statistics purposes where there is no decision-making about an individual involved, as per standards prescribed in rules.

The Central Government can exempt Data Fiduciaries, including startups, based on the volume and nature of personal data from obligations such as data retention, accuracy, and notice through notifications. It can exempt certain state instrumentalities from retention, erasure, and correction obligations when the personal data is not being processed to decide about an individual.

Data Protection Board of India and the Appellate Tribunal

The Act establishes the DPB as an independent body to inquire and impose penalties in relation to, personal data breaches reported to it, complaints from Data Principals, and references from the Central or State Governments. It will also be registering the Consent Managers.

The Board will operate as a digital office and adopt techno-legal methods to ensure it is “digital by design”. It has been granted the powers of a civil court.

The Act authorises the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) to serve as an appellate authority. Appeals to the TDSAT must be filed within 60 days of the Board's decision.

The Board can opt for mediation to resolve disputes and has the authority to accept voluntary undertakings during proceedings. Acceptance of such undertakings can bar the proceedings, but if the terms are violated, the Board can impose a penalty.

Penalties and enforcement

The Board has the power to impose monetary penalties in case of breach, as specified under the Schedule of the Act. Section 33(2) lists factors to be considered to determine penalty amounts.

The Board can ask the Central Government to issue a blocking order to an intermediary (as defined in the IT Act) if there are two or more penalties in place against the intermediary and it is in the interest of the public. This will be after giving the intermediary an opportunity to be heard.

For more information, kindly write to varun@nasscom.in or priyanshi@nasscom.in with a copy to policy@nasscom.in

data protection

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

priyanshi

Senior Associate, Public Policy and Government Affairs

Reach out to me for everything data, platforms, or export controls!