Digital Personal Data Protection Act, 2023 and its Implication on Citizens and Business

Abstract

The Digital Personal Data Protection Act came to life on August 11, 2023, placing India’s Data Protection Laws in the global standards. The act has various implications for the state, citizens, and businesses. Before the DPDP Act, the Indian data record was governed by the IT Act, 2000, and the SPDI Rules 2011, which had numerous limitations to the privacy and security of the state as well as its citizens. The introduction of the DPDP Act paves the way for a more secure and protected way to transfer data of the data principles. This is equivalent to the General Data Protection Regulation (GDPR) followed by the European Union. Efforts to draft this legislature started in 2018, when the Indian government wanted to introduce a replacement to the SPDI Rules 2011 and the IT Act 2000, acknowledging its limitations and bringing in a standalone data protection law. The act is also long overdue due to rapidly changing technology. After releasing multiple drafts over the years, the Lok Sabha passed the “Digital Personal Data Protection Act, 2023” (also known as the “DPDP Act”) on August 3, 2023. On August 9, 2023, the Rajya Sabha passed the DPDP Act in response. Finally, on August 11, 2023, the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) was notified and published in the Official Gazette of India after receiving the President’s assent.