Data Privacy and Legal Safeguards in India: The Framework under the DPDP Act, 2023

In the digital age, personal data has become one of the most valuable of assets. From online banking and e-commerce to social media and government services, data lies at the core of nearly every interaction. For many years the pace of digitisation in India outran the development of a comprehensive legal framework for its protection. That has changed with the enactment of the Digital Personal Data Protection Act, 2023 (the DPDP Act). This article examines the present legal position and its implications for individuals and organisations.

The constitutional foundation

The right to privacy was recognised as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), in which a nine-judge Bench of the Supreme Court held privacy to be intrinsic to the right to life and personal liberty under Article 21. The judgment supplied the impetus for a statutory data-protection regime that treats informational privacy as an element of individual autonomy.

The framework before the DPDP Act

Until recently, data privacy was governed by sectoral regulation and by the Information Technology Act, 2000, principally through the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Those rules obliged body corporates to protect “sensitive personal data or information” — passwords, financial information, health records, biometric data and the like — but the framework had clear limitations: it applied to companies rather than government agencies, lacked strong enforcement, did not reach non-sensitive personal data, and conferred no rights of correction, erasure or portability.

The Digital Personal Data Protection Act, 2023

The DPDP Act, which received assent on 11 August 2023, establishes a framework for the processing of digital personal data within India, and outside India where it involves offering goods or services to persons in India. The Digital Personal Data Protection Rules have since been notified, with obligations coming into force in phases.

Key concepts

• Personal data — any data about an individual who is identifiable by or in relation to it.
• Data Fiduciary — the person who determines the purpose and means of processing.
• Data Principal — the individual to whom the data relates.

Salient features

1. Consent-based processing. Consent must be free, specific, informed, unconditional and unambiguous, requested in clear and plain language, and withdrawable; certain “legitimate uses” are also recognised.
2. Rights of Data Principals. Access to information about processing, correction and erasure, grievance redressal, and nomination of another person to exercise rights in the event of death or incapacity.
3. Obligations of Data Fiduciaries. Lawful processing, reasonable security safeguards, erasure once the purpose is served or consent withdrawn, and notification of breaches to the Board and affected individuals.
4. Significant Data Fiduciaries. Entities processing large volumes or sensitive categories may be so designated and must appoint a Data Protection Officer, conduct periodic audits and carry out impact assessments.
5. Cross-border transfers. Permitted except to countries restricted by the Central Government.
6. Data Protection Board of India. An adjudicatory body to enforce the Act, hear complaints and impose penalties.

Penalties

The Act introduces a stringent penalty regime, with monetary penalties of up to ₹250 crore for failure to take reasonable security safeguards, up to ₹200 crore for failure to notify a breach, and significant sums for other contraventions — a clear signal of legislative intent.

Implications for organisations

The Act applies to private enterprises, startups, multinationals and government departments alike, subject to defined exemptions in the interests of sovereignty, security and public order — exemptions that privacy advocates have questioned. Organisations should now review their data-governance policies, map their processing activities, redesign consent flows, train personnel, implement security measures and, where required, appoint compliance officers.

Challenges ahead

• Operational readiness, particularly for small and medium enterprises.
• Public awareness of privacy rights, which remains limited.
• Rule-making and enforcement, on which much of the Act’s practical effect depends.
• Balancing surveillance and privacy, where the scope of governmental exemptions will merit judicial scrutiny.

Conclusion

The DPDP Act aligns India with global standards such as the EU’s GDPR while retaining a distinct local character. It codifies accountability, transparency and individual empowerment, and places the citizen at the heart of the data economy. The path ahead involves practical and legal challenges, but the shift towards a rights-based regime is a necessary and welcome transformation. Avinash Law Offices advises organisations on DPDP compliance and represents clients in data-related disputes.