[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"content-query-VIOhxSHccl":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"body":11,"_type":1240,"_id":1241,"_source":1242,"_file":1243,"_stem":1244,"_extension":1245},"\u002Fcurrent-affairs\u002Fdigital-personal-data-protection-act","current-affairs",false,"","Digital Personal Data Protection Act 2023: Pros & Cons","Comprehensive UPSC notes and analysis on Digital Personal Data Protection Act 2023: Pros & Cons.","2026-08-11T10:26:24.448Z",{"type":12,"children":13,"toc":1208},"root",[14,23,37,56,60,67,72,82,157,160,166,171,178,222,228,261,267,315,321,365,371,403,409,447,450,456,464,470,475,481,493,499,504,527,533,545,551,556,559,565,570,578,584,596,624,630,642,682,688,693,713,719,724,752,758,770,773,779,939,942,948,953,959,1012,1015,1021],{"type":15,"tag":16,"props":17,"children":19},"element","h1",{"id":18},"digital-personal-data-protection-act-2023-an-in-depth-analysis-of-pros-and-cons",[20],{"type":21,"value":22},"text","Digital Personal Data Protection Act 2023: An In-Depth Analysis of Pros and Cons",{"type":15,"tag":24,"props":25,"children":26},"p",{},[27,29,35],{"type":21,"value":28},"The ",{"type":15,"tag":30,"props":31,"children":32},"strong",{},[33],{"type":21,"value":34},"Digital Personal Data Protection (DPDP) Act 2023",{"type":21,"value":36}," represents a watershed moment in India's digital governance architecture. As India accelerates its transition toward a $1 trillion digital economy, the handling, processing, and safeguarding of personal data have become central to national sovereignty, fundamental rights, and economic growth.",{"type":15,"tag":24,"props":38,"children":39},{},[40,42,47,49,54],{"type":21,"value":41},"Enacted by the Parliament of India in August 2023, the DPDP Act seeks to establish a legal framework for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such data for lawful purposes. For UPSC CSE aspirants, understanding this legislation is critical under ",{"type":15,"tag":30,"props":43,"children":44},{},[45],{"type":21,"value":46},"GS Paper II (Governance, Constitution, Polity)",{"type":21,"value":48}," and ",{"type":15,"tag":30,"props":50,"children":51},{},[52],{"type":21,"value":53},"GS Paper III (Cybersecurity, Technology, Economy)",{"type":21,"value":55},".",{"type":15,"tag":57,"props":58,"children":59},"hr",{},[],{"type":15,"tag":61,"props":62,"children":64},"h2",{"id":63},"historical-background-and-evolution",[65],{"type":21,"value":66},"Historical Background and Evolution",{"type":15,"tag":24,"props":68,"children":69},{},[70],{"type":21,"value":71},"The journey toward India's comprehensive data protection law has been complex, evolving through landmark judicial pronouncements, parliamentary committees, and iterative legislative drafts over six years.",{"type":15,"tag":73,"props":74,"children":76},"pre",{"code":75},"+-------------------------------------------------------------------------------+\n| 2017: Puttaswamy Judgment (Right to Privacy declared Article 21 Fundamental) |\n+-------------------------------------------------------------------------------+\n                                      |\n                                      v\n+-------------------------------------------------------------------------------+\n| 2018: Justice B.N. Srikrishna Committee Draft Personal Data Protection Bill  |\n+-------------------------------------------------------------------------------+\n                                      |\n                                      v\n+-------------------------------------------------------------------------------+\n| 2019–2021: Introduction of PDP Bill 2019 & Joint Parliamentary Committee (JPC)|\n+-------------------------------------------------------------------------------+\n                                      |\n                                      v\n+-------------------------------------------------------------------------------+\n| 2022: Withdrawal of PDP Bill 2019 & Release of Draft DPDP Bill 2022           |\n+-------------------------------------------------------------------------------+\n                                      |\n                                      v\n+-------------------------------------------------------------------------------+\n| August 2023: Passage of Digital Personal Data Protection Act 2023            |\n+-------------------------------------------------------------------------------+\n",[77],{"type":15,"tag":78,"props":79,"children":80},"code",{"__ignoreMap":7},[81],{"type":21,"value":75},{"type":15,"tag":83,"props":84,"children":85},"ol",{},[86,117,127,137,147],{"type":15,"tag":87,"props":88,"children":89},"li",{},[90,95,97,102,104,109,111,116],{"type":15,"tag":30,"props":91,"children":92},{},[93],{"type":21,"value":94},"Justice K.S. Puttaswamy v. Union of India (2017):",{"type":21,"value":96}," A unanimous nine-judge Bench of the Supreme Court held that the ",{"type":15,"tag":30,"props":98,"children":99},{},[100],{"type":21,"value":101},"Right to Privacy",{"type":21,"value":103}," is an intrinsic part of the Right to Life and Personal Liberty under ",{"type":15,"tag":30,"props":105,"children":106},{},[107],{"type":21,"value":108},"Article 21",{"type":21,"value":110}," of the Constitution. The Court established the three-fold test for state intrusion into privacy: ",{"type":15,"tag":30,"props":112,"children":113},{},[114],{"type":21,"value":115},"Legality, Need\u002FLegitimate Aim, and Proportionality",{"type":21,"value":55},{"type":15,"tag":87,"props":118,"children":119},{},[120,125],{"type":15,"tag":30,"props":121,"children":122},{},[123],{"type":21,"value":124},"Justice B.N. Srikrishna Committee (2017–2018):",{"type":21,"value":126}," Formed by the Ministry of Electronics and Information Technology (MeitY) to draft a data protection framework. The committee submitted its report along with the draft Personal Data Protection Bill, 2018.",{"type":15,"tag":87,"props":128,"children":129},{},[130,135],{"type":15,"tag":30,"props":131,"children":132},{},[133],{"type":21,"value":134},"Joint Parliamentary Committee (JPC) Review (2019–2021):",{"type":21,"value":136}," The government introduced the Personal Data Protection Bill, 2019, in Lok Sabha, which was referred to a JPC chaired by PP Chaudhary. The JPC suggested 81 amendments and expanded the scope to include non-personal data.",{"type":15,"tag":87,"props":138,"children":139},{},[140,145],{"type":15,"tag":30,"props":141,"children":142},{},[143],{"type":21,"value":144},"Withdrawal and Re-drafting (2022):",{"type":21,"value":146}," Citing the complexity of the JPC's recommendations, the government withdrew the 2019 Bill in August 2022 and published a simplified draft called the Digital Personal Data Protection Bill, 2022.",{"type":15,"tag":87,"props":148,"children":149},{},[150,155],{"type":15,"tag":30,"props":151,"children":152},{},[153],{"type":21,"value":154},"Enactment (2023):",{"type":21,"value":156}," The Digital Personal Data Protection Act received Presidential assent on August 11, 2023, officially replacing Section 43A of the Information Technology Act, 2000.",{"type":15,"tag":57,"props":158,"children":159},{},[],{"type":15,"tag":61,"props":161,"children":163},{"id":162},"key-features-and-architectural-framework",[164],{"type":21,"value":165},"Key Features and Architectural Framework",{"type":15,"tag":24,"props":167,"children":168},{},[169],{"type":21,"value":170},"The DPDP Act 2023 is built on principles of data minimization, purpose limitation, storage limitation, and accountability. It adopts a plain-language drafting approach, utilizing singular masculine pronouns (\"he\u002Fhim\") as a drafting convention to represent all genders (inclusive language clause).",{"type":15,"tag":172,"props":173,"children":175},"h3",{"id":174},"_1-key-terminology-and-stakeholders",[176],{"type":21,"value":177},"1. Key Terminology and Stakeholders",{"type":15,"tag":179,"props":180,"children":181},"ul",{},[182,192,202,212],{"type":15,"tag":87,"props":183,"children":184},{},[185,190],{"type":15,"tag":30,"props":186,"children":187},{},[188],{"type":21,"value":189},"Data Principal:",{"type":21,"value":191}," The individual to whom the personal data relates. If the individual is a child (under 18 years) or a person with a disability, it includes their legal guardian.",{"type":15,"tag":87,"props":193,"children":194},{},[195,200],{"type":15,"tag":30,"props":196,"children":197},{},[198],{"type":21,"value":199},"Data Fiduciary:",{"type":21,"value":201}," Any person or entity that determines the purpose and means of processing personal data (akin to \"Data Controller\" under GDPR).",{"type":15,"tag":87,"props":203,"children":204},{},[205,210],{"type":15,"tag":30,"props":206,"children":207},{},[208],{"type":21,"value":209},"Data Processor:",{"type":21,"value":211}," Any person or entity that processes personal data on behalf of a Data Fiduciary.",{"type":15,"tag":87,"props":213,"children":214},{},[215,220],{"type":15,"tag":30,"props":216,"children":217},{},[218],{"type":21,"value":219},"Significant Data Fiduciary (SDF):",{"type":21,"value":221}," Class of Data Fiduciaries notified by the Central Government based on factors like volume of data, risk to rights, national security, and public order. SDFs face higher compliance burdens (e.g., appointing a Data Protection Officer and conducting Data Protection Impact Assessments).",{"type":15,"tag":172,"props":223,"children":225},{"id":224},"_2-scope-and-applicability",[226],{"type":21,"value":227},"2. Scope and Applicability",{"type":15,"tag":179,"props":229,"children":230},{},[231,241,251],{"type":15,"tag":87,"props":232,"children":233},{},[234,239],{"type":15,"tag":30,"props":235,"children":236},{},[237],{"type":21,"value":238},"Territorial Scope:",{"type":21,"value":240}," Applies to the processing of digital personal data within India.",{"type":15,"tag":87,"props":242,"children":243},{},[244,249],{"type":15,"tag":30,"props":245,"children":246},{},[247],{"type":21,"value":248},"Extra-Territorial Scope:",{"type":21,"value":250}," Applies to processing outside India if it involves offering goods or services to Data Principals within India.",{"type":15,"tag":87,"props":252,"children":253},{},[254,259],{"type":15,"tag":30,"props":255,"children":256},{},[257],{"type":21,"value":258},"Exclusions:",{"type":21,"value":260}," Does not apply to non-digital personal data, personal data processed by an individual for personal or domestic purposes, or personal data publicly made available by the Data Principal.",{"type":15,"tag":172,"props":262,"children":264},{"id":263},"_3-consent-and-legal-basis-for-processing",[265],{"type":21,"value":266},"3. Consent and Legal Basis for Processing",{"type":15,"tag":179,"props":268,"children":269},{},[270,295,305],{"type":15,"tag":87,"props":271,"children":272},{},[273,275,280,282,287,289,294],{"type":21,"value":274},"Data can only be processed for a ",{"type":15,"tag":30,"props":276,"children":277},{},[278],{"type":21,"value":279},"lawful purpose",{"type":21,"value":281}," based on explicit ",{"type":15,"tag":30,"props":283,"children":284},{},[285],{"type":21,"value":286},"consent",{"type":21,"value":288}," or for certain ",{"type":15,"tag":30,"props":290,"children":291},{},[292],{"type":21,"value":293},"\"Legitimate Uses\"",{"type":21,"value":55},{"type":15,"tag":87,"props":296,"children":297},{},[298,303],{"type":15,"tag":30,"props":299,"children":300},{},[301],{"type":21,"value":302},"Notice Requirement:",{"type":21,"value":304}," Consent must be preceded or accompanied by a clear, accessible notice detailing the data collected, purpose, and procedure to exercise rights and lodge complaints.",{"type":15,"tag":87,"props":306,"children":307},{},[308,313],{"type":15,"tag":30,"props":309,"children":310},{},[311],{"type":21,"value":312},"Legitimate Uses:",{"type":21,"value":314}," Include voluntary provision of data by the Data Principal, medical emergencies, employment purposes, national security, and legal obligations.",{"type":15,"tag":172,"props":316,"children":318},{"id":317},"_4-rights-and-duties-of-data-principals",[319],{"type":21,"value":320},"4. Rights and Duties of Data Principals",{"type":15,"tag":179,"props":322,"children":323},{},[324,355],{"type":15,"tag":87,"props":325,"children":326},{},[327,332],{"type":15,"tag":30,"props":328,"children":329},{},[330],{"type":21,"value":331},"Rights:",{"type":15,"tag":179,"props":333,"children":334},{},[335,340,345,350],{"type":15,"tag":87,"props":336,"children":337},{},[338],{"type":21,"value":339},"Right to access information about processing activities.",{"type":15,"tag":87,"props":341,"children":342},{},[343],{"type":21,"value":344},"Right to correction, completion, updating, and erasure of personal data.",{"type":15,"tag":87,"props":346,"children":347},{},[348],{"type":21,"value":349},"Right to grievance redressal.",{"type":15,"tag":87,"props":351,"children":352},{},[353],{"type":21,"value":354},"Right to nominate an individual to exercise rights in the event of death or incapacity.",{"type":15,"tag":87,"props":356,"children":357},{},[358,363],{"type":15,"tag":30,"props":359,"children":360},{},[361],{"type":21,"value":362},"Duties:",{"type":21,"value":364}," Data Principals must not lodge false or frivolous complaints, furnish false particulars, or impersonate another person. Violation carries a penalty of up to ₹10,000.",{"type":15,"tag":172,"props":366,"children":368},{"id":367},"_5-institutional-governance-data-protection-board-of-india-dpbi",[369],{"type":21,"value":370},"5. Institutional Governance: Data Protection Board of India (DPBI)",{"type":15,"tag":179,"props":372,"children":373},{},[374,386,391],{"type":15,"tag":87,"props":375,"children":376},{},[377,379,384],{"type":21,"value":378},"Establishes the ",{"type":15,"tag":30,"props":380,"children":381},{},[382],{"type":21,"value":383},"Data Protection Board of India (DPBI)",{"type":21,"value":385}," as a digital-first adjudicatory body.",{"type":15,"tag":87,"props":387,"children":388},{},[389],{"type":21,"value":390},"The Board is empowered to inquire into data breaches, impose financial penalties, and direct urgent remedial measures.",{"type":15,"tag":87,"props":392,"children":393},{},[394,396,401],{"type":21,"value":395},"Appeals against DPBI decisions lie with the ",{"type":15,"tag":30,"props":397,"children":398},{},[399],{"type":21,"value":400},"Telecom Disputes Settlement and Appellate Tribunal (TDSAT)",{"type":21,"value":402},", and subsequently with the Supreme Court.",{"type":15,"tag":172,"props":404,"children":406},{"id":405},"_6-penalties-and-liabilities",[407],{"type":21,"value":408},"6. Penalties and Liabilities",{"type":15,"tag":179,"props":410,"children":411},{},[412,424,436],{"type":15,"tag":87,"props":413,"children":414},{},[415,417,422],{"type":21,"value":416},"The Act replaces criminal penalties with ",{"type":15,"tag":30,"props":418,"children":419},{},[420],{"type":21,"value":421},"graded civil financial penalties",{"type":21,"value":423}," payable to the Consolidated Fund of India.",{"type":15,"tag":87,"props":425,"children":426},{},[427,429,434],{"type":21,"value":428},"Max penalty up to ",{"type":15,"tag":30,"props":430,"children":431},{},[432],{"type":21,"value":433},"₹250 crore",{"type":21,"value":435}," for failure to take reasonable security safeguards to prevent personal data breaches.",{"type":15,"tag":87,"props":437,"children":438},{},[439,440,445],{"type":21,"value":428},{"type":15,"tag":30,"props":441,"children":442},{},[443],{"type":21,"value":444},"₹200 crore",{"type":21,"value":446}," for failure to fulfill obligations in relation to children's data.",{"type":15,"tag":57,"props":448,"children":449},{},[],{"type":15,"tag":61,"props":451,"children":453},{"id":452},"significance-and-pros-of-the-dpdp-act-2023",[454],{"type":21,"value":455},"Significance and Pros of the DPDP Act 2023",{"type":15,"tag":73,"props":457,"children":459},{"code":458},"+-----------------------------------------------------------------------+\n|                        PROS OF DPDP ACT 2023                          |\n+-----------------------------------------------------------------------+\n| 1. Economic Growth & Digital Trust ($1 Trillion Digital Economy)      |\n| 2. Consumer Empowerment & Data Rights (Consent Architecture)          |\n| 3. Ease of Doing Business (Simplified, Decriminalized Compliance)     |\n| 4. Protection of Children & Vulnerable Groups (Verifiable Consent)    |\n| 5. Cross-Border Data Flow (Blacklisting Mechanism replacing Localization)|\n+-----------------------------------------------------------------------+\n",[460],{"type":15,"tag":78,"props":461,"children":462},{"__ignoreMap":7},[463],{"type":21,"value":458},{"type":15,"tag":172,"props":465,"children":467},{"id":466},"_1-strengthening-the-digital-economy-and-global-competitiveness",[468],{"type":21,"value":469},"1. Strengthening the Digital Economy and Global Competitiveness",{"type":15,"tag":24,"props":471,"children":472},{},[473],{"type":21,"value":474},"The Act provides legal certainty for international technology companies operating in India and domestic firms expanding globally. By providing a structured regulatory environment, it helps build consumer trust in digital services, fintech, e-commerce, and HealthTech, acting as a force multiplier for India's digital economy.",{"type":15,"tag":172,"props":476,"children":478},{"id":477},"_2-paradigm-shift-to-consent-architecture-and-individual-autonomy",[479],{"type":21,"value":480},"2. Paradigm Shift to Consent Architecture and Individual Autonomy",{"type":15,"tag":24,"props":482,"children":483},{},[484,486,491],{"type":21,"value":485},"By establishing the concept of ",{"type":15,"tag":30,"props":487,"children":488},{},[489],{"type":21,"value":490},"\"Consent Managers\"",{"type":21,"value":492}," (intermediaries registered with the Board through whom Data Principals can give, manage, review, or withdraw consent), the law operationalizes individual control over data. Data Principals have explicit rights to erase data once the purpose is served, enforcing the principle of storage limitation.",{"type":15,"tag":172,"props":494,"children":496},{"id":495},"_3-simplified-compliance-and-ease-of-doing-business",[497],{"type":21,"value":498},"3. Simplified Compliance and Ease of Doing Business",{"type":15,"tag":24,"props":500,"children":501},{},[502],{"type":21,"value":503},"Unlike earlier drafts (such as the 2019 Bill) that contained heavily bureaucratic requirements—such as strict data localization and categorizations like \"sensitive\" and \"critical\" personal data—the 2023 Act streamlines compliance:",{"type":15,"tag":179,"props":505,"children":506},{},[507,517],{"type":15,"tag":87,"props":508,"children":509},{},[510,515],{"type":15,"tag":30,"props":511,"children":512},{},[513],{"type":21,"value":514},"Blacklisting approach for Cross-Border Data Transfers:",{"type":21,"value":516}," Data can flow freely to all countries except those explicitly restricted by the Central Government.",{"type":15,"tag":87,"props":518,"children":519},{},[520,525],{"type":15,"tag":30,"props":521,"children":522},{},[523],{"type":21,"value":524},"Decriminalization:",{"type":21,"value":526}," Eliminates prison terms for breaches, replacing them with monetary penalties, alleviating fear of criminal prosecution for bona fide mistakes.",{"type":15,"tag":172,"props":528,"children":530},{"id":529},"_4-robust-framework-for-child-data-safety",[531],{"type":21,"value":532},"4. Robust Framework for Child Data Safety",{"type":15,"tag":24,"props":534,"children":535},{},[536,538,543],{"type":21,"value":537},"Section 9 mandates that Data Fiduciaries obtain ",{"type":15,"tag":30,"props":539,"children":540},{},[541],{"type":21,"value":542},"verifiable parental consent",{"type":21,"value":544}," before processing data of children (below 18 years). It prohibits tracking, behavioral monitoring, and targeted advertising directed at children, mitigating risks like online grooming, cyberbullying, and digital addiction.",{"type":15,"tag":172,"props":546,"children":548},{"id":547},"_5-digital-by-design-governance",[549],{"type":21,"value":550},"5. Digital-by-Design Governance",{"type":15,"tag":24,"props":552,"children":553},{},[554],{"type":21,"value":555},"The DPBI is mandated to function as a digital office, utilizing online complaint filing, digital hearings, and electronic order delivery. This aligns with the \"Digital India\" vision and ensures speedy, transparent dispute resolution without geographic barriers.",{"type":15,"tag":57,"props":557,"children":558},{},[],{"type":15,"tag":61,"props":560,"children":562},{"id":561},"challenges-concerns-and-cons",[563],{"type":21,"value":564},"Challenges, Concerns, and Cons",{"type":15,"tag":24,"props":566,"children":567},{},[568],{"type":21,"value":569},"Despite its progressive features, the DPDP Act 2023 faces significant criticism from legal scholars, privacy advocates, civil society, and regulatory experts.",{"type":15,"tag":73,"props":571,"children":573},{"code":572},"+-----------------------------------------------------------------------+\n|                        CONS OF DPDP ACT 2023                          |\n+-----------------------------------------------------------------------+\n| 1. Overbroad State Exemptions (Article 21 & Puttaswamy Violations)    |\n| 2. Dilution of Right to Information (RTI Act Section 8(1)(j) Amendment)|\n| 3. Compromised Independence of the Data Protection Board (DPBI)       |\n| 4. Absence of Crucial Rights (Data Portability, Right to be Forgotten)|\n| 5. Executive Delegation & Operational Uncertainties (\"As Prescribed\")|\n+-----------------------------------------------------------------------+\n",[574],{"type":15,"tag":78,"props":575,"children":576},{"__ignoreMap":7},[577],{"type":21,"value":572},{"type":15,"tag":172,"props":579,"children":581},{"id":580},"_1-blanket-state-exemptions-and-executive-overreach",[582],{"type":21,"value":583},"1. Blanket State Exemptions and Executive Overreach",{"type":15,"tag":24,"props":585,"children":586},{},[587,589,594],{"type":21,"value":588},"Under ",{"type":15,"tag":30,"props":590,"children":591},{},[592],{"type":21,"value":593},"Section 17",{"type":21,"value":595},", the Central Government reserves the power to exempt any government agency or instrumentality from the application of the Act in the interest of national security, sovereignty, public order, and friendly relations with foreign states.",{"type":15,"tag":179,"props":597,"children":598},{},[599],{"type":15,"tag":87,"props":600,"children":601},{},[602,607,609,614,616,622],{"type":15,"tag":30,"props":603,"children":604},{},[605],{"type":21,"value":606},"Constitutional Issue:",{"type":21,"value":608}," Critics argue that these exemptions fail the ",{"type":15,"tag":30,"props":610,"children":611},{},[612],{"type":21,"value":613},"proportionality and necessity tests",{"type":21,"value":615}," laid down in the ",{"type":15,"tag":617,"props":618,"children":619},"em",{},[620],{"type":21,"value":621},"Puttaswamy",{"type":21,"value":623}," judgment. Without judicial oversight or independent oversight mechanisms, this opens the door to potential mass surveillance.",{"type":15,"tag":172,"props":625,"children":627},{"id":626},"_2-dilution-of-the-right-to-information-rti-act-2005",[628],{"type":21,"value":629},"2. Dilution of the Right to Information (RTI) Act, 2005",{"type":15,"tag":24,"props":631,"children":632},{},[633,635,640],{"type":21,"value":634},"Section 44 of the DPDP Act amends ",{"type":15,"tag":30,"props":636,"children":637},{},[638],{"type":21,"value":639},"Section 8(1)(j)",{"type":21,"value":641}," of the RTI Act.",{"type":15,"tag":179,"props":643,"children":644},{},[645,662,672],{"type":15,"tag":87,"props":646,"children":647},{},[648,653,655,660],{"type":15,"tag":30,"props":649,"children":650},{},[651],{"type":21,"value":652},"Earlier Provision:",{"type":21,"value":654}," Allowed public authorities to withhold personal information ",{"type":15,"tag":617,"props":656,"children":657},{},[658],{"type":21,"value":659},"unless",{"type":21,"value":661}," the larger public interest justified its disclosure.",{"type":15,"tag":87,"props":663,"children":664},{},[665,670],{"type":15,"tag":30,"props":666,"children":667},{},[668],{"type":21,"value":669},"Amended Provision:",{"type":21,"value":671}," Imposes an absolute bar on the disclosure of all personal information of public officials under RTI, regardless of public interest.",{"type":15,"tag":87,"props":673,"children":674},{},[675,680],{"type":15,"tag":30,"props":676,"children":677},{},[678],{"type":21,"value":679},"Impact:",{"type":21,"value":681}," Transparency activists point out that this significantly weakens public accountability, making it impossible to audit assets of bureaucrats, discretionary spending, or recruitment scams.",{"type":15,"tag":172,"props":683,"children":685},{"id":684},"_3-lack-of-independence-of-the-data-protection-board-dpbi",[686],{"type":21,"value":687},"3. Lack of Independence of the Data Protection Board (DPBI)",{"type":15,"tag":24,"props":689,"children":690},{},[691],{"type":21,"value":692},"The DPBI is not designed as an autonomous statutory regulator (like SEBI or CCI), but rather as an adjudicatory board.",{"type":15,"tag":179,"props":694,"children":695},{},[696,701],{"type":15,"tag":87,"props":697,"children":698},{},[699],{"type":21,"value":700},"The Central Government determines the composition, selection process, terms of service, and removal of DPBI members.",{"type":15,"tag":87,"props":702,"children":703},{},[704,706,711],{"type":21,"value":705},"Since the government is one of the largest collectors and processors of data in India, an executive-appointed Board creates an inherent ",{"type":15,"tag":30,"props":707,"children":708},{},[709],{"type":21,"value":710},"conflict of interest",{"type":21,"value":712}," when adjudicating disputes involving state agencies.",{"type":15,"tag":172,"props":714,"children":716},{"id":715},"_4-omission-of-rights-available-under-global-standards-gdpr",[717],{"type":21,"value":718},"4. Omission of Rights Available Under Global Standards (GDPR)",{"type":15,"tag":24,"props":720,"children":721},{},[722],{"type":21,"value":723},"The DPDP Act omits critical rights recognized under international standards like the EU's General Data Protection Regulation (GDPR):",{"type":15,"tag":179,"props":725,"children":726},{},[727,737,747],{"type":15,"tag":87,"props":728,"children":729},{},[730,735],{"type":15,"tag":30,"props":731,"children":732},{},[733],{"type":21,"value":734},"Right to Data Portability:",{"type":21,"value":736}," Allows users to transfer their data seamlessly between service providers, essential for competition.",{"type":15,"tag":87,"props":738,"children":739},{},[740,745],{"type":15,"tag":30,"props":741,"children":742},{},[743],{"type":21,"value":744},"Right to be Forgotten:",{"type":21,"value":746}," Explicit recognition of the right to mask or un-index historical personal information from digital platforms.",{"type":15,"tag":87,"props":748,"children":749},{},[750],{"type":21,"value":751},"Furthermore, the Act does not categorize personal data into \"Sensitive Personal Data\" (biometric, financial, medical), treating all personal data under a uniform regulatory threshold.",{"type":15,"tag":172,"props":753,"children":755},{"id":754},"_5-excessive-executive-delegation-rule-making-powers",[756],{"type":21,"value":757},"5. Excessive Executive Delegation (\"Rule-Making Powers\")",{"type":15,"tag":24,"props":759,"children":760},{},[761,763,768],{"type":21,"value":762},"The Act frequently relies on the phrase ",{"type":15,"tag":30,"props":764,"children":765},{},[766],{"type":21,"value":767},"\"as may be prescribed\"",{"type":21,"value":769}," (over 25 instances). Key operational aspects—such as the mechanism for verifiable parental consent, exemptions for startups, and timelines for handling breaches—have been delegated to subordinate legislation (rules), leaving the core law structural but hollow pending rule notification.",{"type":15,"tag":57,"props":771,"children":772},{},[],{"type":15,"tag":61,"props":774,"children":776},{"id":775},"critical-comparative-analysis-dpdp-act-2023-vs-eu-gdpr",[777],{"type":21,"value":778},"Critical Comparative Analysis: DPDP Act 2023 vs. EU GDPR",{"type":15,"tag":780,"props":781,"children":782},"table",{},[783,808],{"type":15,"tag":784,"props":785,"children":786},"thead",{},[787],{"type":15,"tag":788,"props":789,"children":790},"tr",{},[791,798,803],{"type":15,"tag":792,"props":793,"children":795},"th",{"align":794},"left",[796],{"type":21,"value":797},"Feature",{"type":15,"tag":792,"props":799,"children":800},{"align":794},[801],{"type":21,"value":802},"DPDP Act 2023 (India)",{"type":15,"tag":792,"props":804,"children":805},{"align":794},[806],{"type":21,"value":807},"GDPR (European Union)",{"type":15,"tag":809,"props":810,"children":811},"tbody",{},[812,834,855,876,897,918],{"type":15,"tag":788,"props":813,"children":814},{},[815,824,829],{"type":15,"tag":816,"props":817,"children":818},"td",{"align":794},[819],{"type":15,"tag":30,"props":820,"children":821},{},[822],{"type":21,"value":823},"Data Classification",{"type":15,"tag":816,"props":825,"children":826},{"align":794},[827],{"type":21,"value":828},"Uniform treatment of personal data (No Sensitive\u002FCritical distinction)",{"type":15,"tag":816,"props":830,"children":831},{"align":794},[832],{"type":21,"value":833},"Categorized into Personal Data and Special Categories (Sensitive) Data",{"type":15,"tag":788,"props":835,"children":836},{},[837,845,850],{"type":15,"tag":816,"props":838,"children":839},{"align":794},[840],{"type":15,"tag":30,"props":841,"children":842},{},[843],{"type":21,"value":844},"Cross-Border Transfer",{"type":15,"tag":816,"props":846,"children":847},{"align":794},[848],{"type":21,"value":849},"Allowed by default, unless blacklisted",{"type":15,"tag":816,"props":851,"children":852},{"align":794},[853],{"type":21,"value":854},"Restricted by default, allowed via Adequacy Decisions \u002F Binding Corporate Rules",{"type":15,"tag":788,"props":856,"children":857},{},[858,866,871],{"type":15,"tag":816,"props":859,"children":860},{"align":794},[861],{"type":15,"tag":30,"props":862,"children":863},{},[864],{"type":21,"value":865},"Data Portability",{"type":15,"tag":816,"props":867,"children":868},{"align":794},[869],{"type":21,"value":870},"Not Recognized",{"type":15,"tag":816,"props":872,"children":873},{"align":794},[874],{"type":21,"value":875},"Recognized as a fundamental statutory right",{"type":15,"tag":788,"props":877,"children":878},{},[879,887,892],{"type":15,"tag":816,"props":880,"children":881},{"align":794},[882],{"type":15,"tag":30,"props":883,"children":884},{},[885],{"type":21,"value":886},"State Exemptions",{"type":15,"tag":816,"props":888,"children":889},{"align":794},[890],{"type":21,"value":891},"Broad executive exemptions on national security grounds",{"type":15,"tag":816,"props":893,"children":894},{"align":794},[895],{"type":21,"value":896},"Highly restricted, subject to strict judicial scrutiny and proportionality",{"type":15,"tag":788,"props":898,"children":899},{},[900,908,913],{"type":15,"tag":816,"props":901,"children":902},{"align":794},[903],{"type":15,"tag":30,"props":904,"children":905},{},[906],{"type":21,"value":907},"Regulatory Body",{"type":15,"tag":816,"props":909,"children":910},{"align":794},[911],{"type":21,"value":912},"Data Protection Board of India (Executive-appointed)",{"type":15,"tag":816,"props":914,"children":915},{"align":794},[916],{"type":21,"value":917},"Independent Data Protection Authorities (DPAs)",{"type":15,"tag":788,"props":919,"children":920},{},[921,929,934],{"type":15,"tag":816,"props":922,"children":923},{"align":794},[924],{"type":15,"tag":30,"props":925,"children":926},{},[927],{"type":21,"value":928},"Penalties",{"type":15,"tag":816,"props":930,"children":931},{"align":794},[932],{"type":21,"value":933},"Civil penalties up to ₹250 crore; No criminal liability",{"type":15,"tag":816,"props":935,"children":936},{"align":794},[937],{"type":21,"value":938},"Up to €20 million or 4% of global annual turnover, whichever is higher",{"type":15,"tag":57,"props":940,"children":941},{},[],{"type":15,"tag":61,"props":943,"children":945},{"id":944},"conclusion-and-way-forward",[946],{"type":21,"value":947},"Conclusion and Way Forward",{"type":15,"tag":24,"props":949,"children":950},{},[951],{"type":21,"value":952},"The Digital Personal Data Protection Act 2023 establishes a baseline regulatory regime for India's expanding digital ecosystem. By balancing user rights with business enabling provisions, it reflects India’s pragmatic approach toward digital sovereignty. However, its effectiveness will depend on addressing its key structural defects during implementation.",{"type":15,"tag":172,"props":954,"children":956},{"id":955},"key-recommendations-way-forward",[957],{"type":21,"value":958},"Key Recommendations (Way Forward)",{"type":15,"tag":83,"props":960,"children":961},{},[962,972,982,992,1002],{"type":15,"tag":87,"props":963,"children":964},{},[965,970],{"type":15,"tag":30,"props":966,"children":967},{},[968],{"type":21,"value":969},"Ensuring DPBI Autonomy:",{"type":21,"value":971}," Executive rules must establish an independent, transparent selection committee (including judicial members like the Chief Justice of India or nominee) for appointing DPBI officials to prevent conflict of interest.",{"type":15,"tag":87,"props":973,"children":974},{},[975,980],{"type":15,"tag":30,"props":976,"children":977},{},[978],{"type":21,"value":979},"Harmonizing DPDP with RTI:",{"type":21,"value":981}," The government should re-evaluate Section 44 to re-introduce a clear \"public interest exception,\" preventing public officials from hiding behind privacy laws to evade transparency.",{"type":15,"tag":87,"props":983,"children":984},{},[985,990],{"type":15,"tag":30,"props":986,"children":987},{},[988],{"type":21,"value":989},"Drafting Clear Rules and Sectoral Standard Operating Procedures (SOPs):",{"type":21,"value":991}," Subordinate rules must clarify verifiable parental consent to avoid disrupting online education and social media access for adolescents while ensuring safety.",{"type":15,"tag":87,"props":993,"children":994},{},[995,1000],{"type":15,"tag":30,"props":996,"children":997},{},[998],{"type":21,"value":999},"Graded Compliance Burden for MSMEs and Startups:",{"type":21,"value":1001}," Introduce sandbox environments and tailored compliance exemptions to ensure that small enterprises are not priced out of digital markets by compliance overheads.",{"type":15,"tag":87,"props":1003,"children":1004},{},[1005,1010],{"type":15,"tag":30,"props":1006,"children":1007},{},[1008],{"type":21,"value":1009},"Periodic Parliamentary Oversight:",{"type":21,"value":1011}," Establish regular parliamentary reporting mechanisms to evaluate the frequency and necessity of state exemptions granted under Section 17, ensuring accountability to constitutional standards.",{"type":15,"tag":57,"props":1013,"children":1014},{},[],{"type":15,"tag":61,"props":1016,"children":1018},{"id":1017},"upsc-prelims-fact-file",[1019],{"type":21,"value":1020},"UPSC Prelims Fact File",{"type":15,"tag":780,"props":1022,"children":1023},{},[1024,1040],{"type":15,"tag":784,"props":1025,"children":1026},{},[1027],{"type":15,"tag":788,"props":1028,"children":1029},{},[1030,1035],{"type":15,"tag":792,"props":1031,"children":1032},{"align":794},[1033],{"type":21,"value":1034},"Aspect",{"type":15,"tag":792,"props":1036,"children":1037},{"align":794},[1038],{"type":21,"value":1039},"Key Details for UPSC Prelims",{"type":15,"tag":809,"props":1041,"children":1042},{},[1043,1059,1075,1098,1114,1129,1144,1160,1176,1192],{"type":15,"tag":788,"props":1044,"children":1045},{},[1046,1054],{"type":15,"tag":816,"props":1047,"children":1048},{"align":794},[1049],{"type":15,"tag":30,"props":1050,"children":1051},{},[1052],{"type":21,"value":1053},"Enactment Date",{"type":15,"tag":816,"props":1055,"children":1056},{"align":794},[1057],{"type":21,"value":1058},"August 11, 2023 (Received Presidential Assent)",{"type":15,"tag":788,"props":1060,"children":1061},{},[1062,1070],{"type":15,"tag":816,"props":1063,"children":1064},{"align":794},[1065],{"type":15,"tag":30,"props":1066,"children":1067},{},[1068],{"type":21,"value":1069},"Parent Ministry",{"type":15,"tag":816,"props":1071,"children":1072},{"align":794},[1073],{"type":21,"value":1074},"Ministry of Electronics and Information Technology (MeitY)",{"type":15,"tag":788,"props":1076,"children":1077},{},[1078,1086],{"type":15,"tag":816,"props":1079,"children":1080},{"align":794},[1081],{"type":15,"tag":30,"props":1082,"children":1083},{},[1084],{"type":21,"value":1085},"Constitutional Mandate",{"type":15,"tag":816,"props":1087,"children":1088},{"align":794},[1089,1091,1096],{"type":21,"value":1090},"Article 21 (Right to Privacy - ",{"type":15,"tag":617,"props":1092,"children":1093},{},[1094],{"type":21,"value":1095},"Puttaswamy Judgment, 2017",{"type":21,"value":1097},")",{"type":15,"tag":788,"props":1099,"children":1100},{},[1101,1109],{"type":15,"tag":816,"props":1102,"children":1103},{"align":794},[1104],{"type":15,"tag":30,"props":1105,"children":1106},{},[1107],{"type":21,"value":1108},"Key Entities",{"type":15,"tag":816,"props":1110,"children":1111},{"align":794},[1112],{"type":21,"value":1113},"Data Principal (Individual), Data Fiduciary (Collector\u002FProcessor), Consent Manager",{"type":15,"tag":788,"props":1115,"children":1116},{},[1117,1125],{"type":15,"tag":816,"props":1118,"children":1119},{"align":794},[1120],{"type":15,"tag":30,"props":1121,"children":1122},{},[1123],{"type":21,"value":1124},"Adjudicatory Body",{"type":15,"tag":816,"props":1126,"children":1127},{"align":794},[1128],{"type":21,"value":383},{"type":15,"tag":788,"props":1130,"children":1131},{},[1132,1140],{"type":15,"tag":816,"props":1133,"children":1134},{"align":794},[1135],{"type":15,"tag":30,"props":1136,"children":1137},{},[1138],{"type":21,"value":1139},"Appellate Authority",{"type":15,"tag":816,"props":1141,"children":1142},{"align":794},[1143],{"type":21,"value":400},{"type":15,"tag":788,"props":1145,"children":1146},{},[1147,1155],{"type":15,"tag":816,"props":1148,"children":1149},{"align":794},[1150],{"type":15,"tag":30,"props":1151,"children":1152},{},[1153],{"type":21,"value":1154},"Maximum Financial Penalty",{"type":15,"tag":816,"props":1156,"children":1157},{"align":794},[1158],{"type":21,"value":1159},"₹250 Crore (For failure to prevent data breaches under Schedule 1)",{"type":15,"tag":788,"props":1161,"children":1162},{},[1163,1171],{"type":15,"tag":816,"props":1164,"children":1165},{"align":794},[1166],{"type":15,"tag":30,"props":1167,"children":1168},{},[1169],{"type":21,"value":1170},"Criminal Liability",{"type":15,"tag":816,"props":1172,"children":1173},{"align":794},[1174],{"type":21,"value":1175},"None (Decriminalized regime; purely financial penalties)",{"type":15,"tag":788,"props":1177,"children":1178},{},[1179,1187],{"type":15,"tag":816,"props":1180,"children":1181},{"align":794},[1182],{"type":15,"tag":30,"props":1183,"children":1184},{},[1185],{"type":21,"value":1186},"Cross-Border Transfer Logic",{"type":15,"tag":816,"props":1188,"children":1189},{"align":794},[1190],{"type":21,"value":1191},"Allowed everywhere except notified\u002Fblacklisted jurisdictions",{"type":15,"tag":788,"props":1193,"children":1194},{},[1195,1203],{"type":15,"tag":816,"props":1196,"children":1197},{"align":794},[1198],{"type":15,"tag":30,"props":1199,"children":1200},{},[1201],{"type":21,"value":1202},"Amended Legislation",{"type":15,"tag":816,"props":1204,"children":1205},{"align":794},[1206],{"type":21,"value":1207},"Replaces Sec 43A of IT Act 2000; Amends Sec 8(1)(j) of RTI Act 2005",{"title":7,"searchDepth":1209,"depth":1209,"links":1210},2,[1211,1212,1221,1228,1235,1236,1239],{"id":63,"depth":1209,"text":66},{"id":162,"depth":1209,"text":165,"children":1213},[1214,1216,1217,1218,1219,1220],{"id":174,"depth":1215,"text":177},3,{"id":224,"depth":1215,"text":227},{"id":263,"depth":1215,"text":266},{"id":317,"depth":1215,"text":320},{"id":367,"depth":1215,"text":370},{"id":405,"depth":1215,"text":408},{"id":452,"depth":1209,"text":455,"children":1222},[1223,1224,1225,1226,1227],{"id":466,"depth":1215,"text":469},{"id":477,"depth":1215,"text":480},{"id":495,"depth":1215,"text":498},{"id":529,"depth":1215,"text":532},{"id":547,"depth":1215,"text":550},{"id":561,"depth":1209,"text":564,"children":1229},[1230,1231,1232,1233,1234],{"id":580,"depth":1215,"text":583},{"id":626,"depth":1215,"text":629},{"id":684,"depth":1215,"text":687},{"id":715,"depth":1215,"text":718},{"id":754,"depth":1215,"text":757},{"id":775,"depth":1209,"text":778},{"id":944,"depth":1209,"text":947,"children":1237},[1238],{"id":955,"depth":1215,"text":958},{"id":1017,"depth":1209,"text":1020},"markdown","content:current-affairs:digital-personal-data-protection-act.md","content","current-affairs\u002Fdigital-personal-data-protection-act.md","current-affairs\u002Fdigital-personal-data-protection-act","md"]