The Ministry of Law and Justice has vide notification ref no. CG-DL-E-12082023-248045 dated August 11, 2023 notified “The Digital Personal Data Protection Act, 2023” (Act) on August 12, 2023 with a view to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes.
The Act shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act.
Key Highlights of the Act are as under:
1. Applicability
The Act applies to:
Processing of digital personal data within India where such data is:
- in digital form; or
- in non-digital form and digitised subsequently.
Processing of personal data outside India, if it is for offering goods or services to Data Principals in India.
The Act does not apply in the following instances:
- personal data processed by an individual for any personal or domestic purpose;
- personal data that is made or caused to be made publicly available by data principal any other person who is obligated by law to make the data publicly available.
2. Important Definitions:
- “ Personal Data ” means any data about an individual who is identifiable by or in relation to such data.
- “ Data Fiduciary ” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
- “ Data Principal ” means the individual to whom the personal data relates and where such individual is—
1. a child, includes the parents or lawful guardian of such a child;
2. a person with disability, includes her lawful guardian, acting on her behalf.
- “ Data Processor ” means any person who processes personal data on behalf of a Data Fiduciary.
- “ Consent Manager ” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
- “ Significant Data Fiduciary ” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.
- “ Data Protection Officer ” means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10.
3. Processing personal data by Data Fiduciary:
- A person may process the personal data of a Data Principal only in accordance with the provisions of this Act, for a lawful purpose and for which Data Principal’s consent has been provided.
- Every request made to a Data Principal for consent shall be accompanied or preceded by a notice given by the Data Fiduciary, informing about:
(i) the personal data and the purpose for which the same is proposed to be processed (ii) the manner in which he/she may exercise their rights
(iii) the manner in which the Data Principal may make a complaint to the Board.
3. Where the Data Principal’s consent to process his/her personal data has already been received, before the commencement of this Act, the Data Fiduciary is required to inform the Data Principal of the details mentioned in Point No. 2 above within a reasonable period of time, and the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws his/her consent.
4. The Data Fiduciary shall give the Data Principal the option to access the contents of the notice in English or any language specified in the Eighth Schedule to the Constitution.
5. The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of his/her personal data for the specified purpose.
6. Any part of consent which constitutes an infringement of the provisions of this Act shall be invalid to the extent of such infringement.
7. The Data Principal shall have a right to withdraw his/her consent any time and the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing such personal data.
8. The Data Fiduciary shall be obliged to prove that a notice was sent to the Data Principal and consent was given by such Data Principal, in accordance with the provisions of this Act and the rules made thereunder.
4. Legitimate Uses:
The Act allows for processing of personal data in the following cases:
- For the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data.
- For the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed.
- For the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State.
- For fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities.
- For compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India.
- For responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual.
- For taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health.
- For taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order.
- For the purposes of employment or those related to safeguarding the employer from loss or liability.
5. General obligations of Data Fiduciary:
- A Data Fiduciary shall be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor.
- Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor, only under a valid contract
- The Data Fiduciary processing personal data shall ensure completeness, accuracy and consistency of such data while making a decision affecting Data Principal or disclosing the said data to another Data Fiduciary
- A Data Fiduciary shall take reasonable security safeguards to prevent personal data breach. In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
- Data Fiduciary shall, unless retention is necessary for compliance with any law, erase personal data or cause erasure of the said data by its Data Processor upon withdrawal of consent by Data Principal or completion of specified purpose, whichever is earlier.
- A Data Fiduciary shall establish an effective mechanism to redress the grievances of Data Principals and also publish contact details of Data Protection Officer, if applicable, or a person who is able to address queries on behalf of the Data Fiduciary.
6. Rights & Duties of Data Principal:
- An individual, whose data is being processed (data principal), will have the right to access:
- summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data.
- identifies of all other Data Fiduciaries and Data Processors with whom the personal data has been shared along with description of such shared data.
- any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
2. Moreover, the Data Principal will have the right to:
- correction, completion, updating and erasure of her personal data which he/she had consented for processing
- seek grievance redressal
- nominate any other individual exercise rights in the event of death or incapacity of the Data Principal.
3.The Data Principal shall:
- comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act.
- ensure not to impersonate another person while providing her personal data for a specified purpose.
- ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the state or any of its instrumentalities.
- ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board.
- and to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.
7. Significant Data Fiduciary:
- The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary on the basis of an assessment of relevant factors.
- The Significant Data Fiduciary shall
(i) appoint a Data Protection Officer, responsible to its Board of Directors and based in India, who shall represent the Significant Data Fiduciary under the provisions of this Act and act as point of contact for the grievance redressal
(ii) appoint an independent data auditor to carry out data audit
(iii) undertake periodic Data Protection Impact Assessment
(iv) undertake periodic audit and other measures as may be specified.
8. The Act also lists down various instances wherein the obligations of the Data Fiduciary may be exempted e.g. processing of data for enforcing any legal right or claim, processing of data by any court or tribunal or such other body for performance of any judicial or quasi-judicial function etc.
9. The Central Government shall restrict the transfer of any personal data by a Data Fiduciary for processing to notified countries or territories outside India, by way of notification.
10 . Data Protection Board of India.
A Data Protection Board of India (Board) shall be constituted which will act as the presiding authority to deal with the matters of the Act and shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908. The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding. Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal.
11. Penalties.
The Schedule to the Act specifies penalties for various breaches as under:
Sr. No
Breach of provisions of this Act or rules made thereunder
Penalty
1
Obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach
Up to Rs.250 Crores
2
Obligation to give the Board or affected Data Principal, notice of a personal data breach
Up to Rs.200 Crores
3
Additional obligations in relation to children
Up to Rs.200 Crores
4
Additional obligations of Significant Data Fiduciary
Up to Rs.150 Crores
5
Duties of Data Principal
Up to Rs.10,000
6
Any term of voluntary undertaking accepted by the Board
Up to the extent applicable for the breach in respect of which the proceedings were instituted before the Board under section 28.
7
Any other provision of this Act or the rules made thereunder
Up to Rs.50 Crores
A copy of the Act is attached herewith for your ready reference.
Source category: Others
Attachments
- /2023/245_Digital_Personal_Data_Protection_Act,_2023_(1).pdf
Comments are closed