1. Overview & Applicability of DPDP Act 2023
The Digital Personal Data Protection (DPDP) Act, 2023 is India\'s comprehensive statutory framework governing the processing of digital personal data. The Act applies to personal data collected in digital form or digitized from non-digital records, and extraterritorially to processing outside India if it involves offering goods or services to Data Principals in India.
2. Data Fiduciary vs Data Principal Obligations
The Act establishes clear statutory roles:
- Data Principal: The individual to whom the personal data relates (or parent/lawful guardian in case of a child).
- Data Fiduciary: Any person or entity that determines the purpose and means of processing personal data. Responsible for statutory compliance, data accuracy, security safeguards, and grievance redressal.
- Data Processor: Any person or entity that processes personal data on behalf of a Data Fiduciary under a valid data processing contract.
3. The Multi-Lingual Consent & Notice Architecture
Under Section 6, consent must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. Every consent request must be accompanied by an itemized notice explaining the exact data collected and purpose, available in English and all 22 languages specified in the Eighth Schedule to the Constitution of India.
4. Processing Children\'s Data (Section 9)
Before processing personal data of a child (under 18 years), entities must obtain verifiable parental consent. The Act strictly prohibits tracking, behavioral monitoring, or targeted advertising directed at children.
5. Mandatory Data Breach Reporting to DPBI
In the event of a personal data breach, Data Fiduciaries must notify both the Data Protection Board of India (DPBI) and each affected Data Principal in such form and manner as prescribed by rules.
6. Statutory Penalties (Up to ₹250 Crore) & Checklist
Statutory Penalties Summary
- Failure to implement reasonable security safeguards: Up to ₹250 Crore
- Failure to report personal data breach to DPBI/Principals: Up to ₹200 Crore
- Breach of duties regarding children\'s data: Up to ₹200 Crore
The DPDP Startup Action Checklist:
- Audit all personal data ingestion pipelines and third-party SDK trackers.
- Deploy granular consent banners and multi-lingual privacy notices.
- Execute Data Processing Addendums (DPAs) with all cloud vendors and sub-processors.
- Establish an operational Data Principal Grievance Redressal Mechanism.
- Conduct internal data privacy and security health audits.
Frequently Asked Questions
VIGOORR's editorial and advisory practice comprises experienced patent attorneys, PhD research methodologists, senior academic editors, and corporate commercial counsels with decades of combined practice across international institutions.