Image for article type insight
Insight

India: Digital Personal Data Protection Act, 2023 part one - scope and application

October 25, 2023
Summary

The Digital Personal Data Protection Act, 2023, enacted in India, aims to provide a framework for processing digital personal data while protecting individual rights. It introduces a fiduciary relationship between data subjects and data controllers, termed as data principals and data fiduciaries, respectively. The Act, which replaces Section 43A of the IT Act and SPDI Rules, applies to digital personal data without sub-categories like sensitive or critical personal data, and has extraterritorial reach for data processed outside India in relation to Indian data principals. It excludes anonymized data, personal/domestic processing, and publicly available data, and allows for exemptions to State and certain data fiduciaries based on various considerations.

Introduction On August 11, 2023, India enacted the Act, which is a result of the fifth iteration of the proposed personal data protection legislation and appears to be based on the draft Bill released by the Ministry of Electronics and Information Technology on November 18, 2022, titled Digital Personal Data Protection Bill, 2022, which was open for public consultations. Once the provisions of the Act are brought into force, it will replace Section 43A of the Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data of Information) Rules, 2011 (SPDI Rules). The Act is proposed to come into force in a pha

Insight

Gain access to unlimited articles with 7 day access to all features, no credit card required.

or

Other options:

Jurisdictions: