The Digital Personal Data Protection Act of India (“DPDPA”)[1] received Presidential assent and was published in the Official Gazette on August 11, 2023, less than a week after it was passed by the lower House of Parliament, marking a watershed moment for data privacy in India. The enactment of the DPDPA is a culmination of India’s ongoing efforts to enact a data protection regime starting from 2017, after the Justice K.S. Puttaswamy v. Union of India[2] judgment identified privacy as a fundamental right in India.
While the DPDPA has been enacted, it hasn’t come into effect yet. Although the DPDPA doesn’t stipulate a transition period, it grants the Central Government the discretion to notify different dates for the enactment of different provisions thereby adopting a phased approach to implementation. Until the DPDPA is brought into force, the existing laws pertaining to data privacy i.e., the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the applicable provisions of the Information Technology Act, 2000 (“IT Act”) will continue to apply.
Here’s an overview of the key provisions of the DPDPA and its implications on businesses looking to develop and implement comprehensive privacy compliance programs in India.
SCOPE & APPLICABILITY
Scope
The DPDPA defines personal data to mean data regarding an individual that can be used to identify such an individual either by or in relation to such data.[3] This means that non-personal data (such as anonymized data) will not be regulated by the DPDPA.
Further, the DPDPA only applies to the processing of digital personal data which is personal data either collected in digital form or collected using other traditional non-electronic methods and digitized subsequently.[4] This means that data of any nature in analogue form remains outside the scope of the DPDPA.
Territorial Applicability
The DPDPA applies to all processing of digital personal data within India.[5] It also applies to the processing of such data outside of India if the processing is in relation to any activity related to the offering of goods and services to data principals in India.[6]
Notably, the definition of data principals is broad and contains no restrictions based either on residence or citizenship. This means that the processing of digital personal data of a foreigner residing in India will be covered by the provisions of the DPDPA.
Exemptions
The DPDPA does not apply to personal data which is processed for personal or domestic use, or that is made publicly available either by the data principal to whom such information relates or by a third-party where required by law.[7]
Additionally, the DPDPA does not apply to the processing of personal data for research, archiving, or statistical purposes subject to such data not being used to make decisions specific to a data principal and being carried out in line with the standards that the Central Government may prescribe.[8]
The Central Government has the power to exempt a) certain government instrumentalities for certain specific purposes including in the interest of the sovereignty and integrity of India, security of the State, and maintaining public order; and b) certain data fiduciaries, including start-ups from the applicability of specific provisions.[9]
GROUNDS FOR PROCESSING PERSONAL DATA
Under the DPDPA, data fiduciaries are responsible for processing personal data for a lawful purpose, and only if the data principal has provided consent, or if it pertains to a legitimate use of such data.[10]
Consent
The DPDPA requires consent to be:n
- Free, specific, informed, unconditional, and unambiguous;
- Provided through a clear affirmative action signifying an agreement; and
- Limited to personal data necessary for the specified purpose.[11]
This signifies that, similar to GDPR, the DPDPA imposes a purpose limitation on collected data i.e., the data may only be used for the specified purpose pursuant to which it was collected. Separate consent must be obtained to process data for a new purpose.
Notice
In order to obtain consent, the data fiduciary must provide a notice to the data principal either prior to or at the time of collection of personal data. Such notice must state the data being collected and the purpose of collection, the rights of a data principal, and grievance redressal measures.[12]
Legacy Data
The DPDPA seeks to address the issue of regulation of data collected prior to its enactment (legacy data). In respect of such legacy data, the data fiduciary is required to provide a notice to the data principal in the same manner set forth above. A data fiduciary may continue processing legacy data until the data principal withdraws consent in respect of such data.[13]
Burden of Proof
Where consent forms the basis for the collection of data, the burden to prove that valid consent was obtained from a data principal lies on the data fiduciary.
LEGITIMATE USES
In addition to consent, the DPDPA classifies other lawful grounds for processing personal data as a legitimate use. This includes data shared during a medical emergency, or for providing medical treatments or health services, disaster relief, or for compliance with a legal order.
The State has been granted broad powers in respect of processing personal data for carrying out any function required by law, including for providing benefits or subsidies, and in the interest of sovereignty and integrity of the country.
Voluntary sharing
A data fiduciary may also process personal data that is shared by a data principal voluntarily (presumably, without the need to obtain consent) and without any indication of objection to such processing, subject to purpose limitation. An example of such sharing enumerated in the DPDPA is where one provides their phone number to acknowledge receipt of payment at a store.
Employment purposes
Employers generally collect vast amounts of personal data such as Aadhaar number, PAN details, and bank account details in the course of employment. A data fiduciary may process data for employment purposes, or to protect employers from loss or liability – without the need to obtain specific consent.
OBLIGATIONS OF DATA FIDUCIARY
Accountability
A data fiduciary is principally accountable for compliance with the DPDPA, and any rules made thereunder by itself and any data processors (who have no direct responsibility under the DPDPA) it engages[14], including the implementation of any technical or organizational measures,[15] and security safeguards,[16] and ensuring completeness, accuracy, and consistency of data[17].
Grievance Redressal
The DPDPA requires a data fiduciary to establish a grievance redressal mechanism[18], however, it does not specify any time period to respond to and resolve such grievances, thus, leaving it open to rule-making [19]. It specifies that the Data Protection Board (“Board”) may only be approached by a data principal after exercising the remedy available through a data fiduciary’s grievance redressal mechanism.[20]
Notice of Breach
In case of a data breach, a data fiduciary must notify the Board and each data principal affected by such breach. The specifications of such notice – including the time period and content will be set out in the rules.
Data Retention
Unless otherwise required by law, a data fiduciary must delete personal data as soon as the purpose for which it was collected is served, or upon withdrawal of consent by the data principal.
Significant Data Fiduciaries
The Central Government has the power to designate significant data fiduciaries, who have additional obligations including carrying out periodic data protection impact assessments, audits, and any other measures set out in the implementing rules.
SPECIAL CATEGORIES OF DATA
The DPDPA creates significant obligations in connection with processing the personal data of children or persons with disabilities. A data fiduciary is required to obtain verifiable consent from a parent or lawful guardian prior to processing such data.
It also prohibits data fiduciaries from engaging in the processing of personal data to undertake tracking, behavioral monitoring, or for the provision of targeted advertisements to children.[21]
RIGHTS AND DUTIES OF DATA PRINCIPALS
A data principal has the right to access the personal data being processed by the data fiduciary, identities of all data fiduciaries and processors with whom the personal data is being shared, and any other information as may be prescribed by the rules. A data principal must be allowed to correct, erase, or update the personal data she provides, and has the right to withdraw consent at any time. In such a case, the data fiduciary must ensure that the process to withdraw consent is as straightforward as that of obtaining consent. A data principal may exercise these rights through a consent manager, who must be accountable to the data principal.
Notably, the rights available to data principals under the DPDPA seem to be rather narrow – it doesn’t allow the data principal to object to processing based on grounds other than consent. In fact, it imposes duties on the data principal, including ensuring compliance with the Act, not registering false complaints, and only furnishing authentic information.[22] Failure to comply with such duties may result in a fine of up to INR 10,000.
CROSS BORDER TRANSFERS
At present, the DPDPA does not restrict cross-border transfer of personal data except to such countries that the Central Government may notify through implementing rules. However, it does not prevent any other law from prescribing a higher threshold of data protection, such as the data localization requirements in relation to payments data imposed by the Reserve Bank of India.
OVERSIGHT
The Board established under the DPDPA will oversee its implementation from the date of its notification by the Central Government, and it shall have all the powers of a civil court. Data principals will be allowed to approach the Board for grievance redressal in line with the requirements of the DPDPA and any subsequent rules to that effect. Civil courts are not allowed to entertain suits or take any action under the DPDPA, although certain remedies, such as writs (where applicable) may be allowed. Any person aggrieved by an order of the Board may appeal to the Appellate Tribunal. The Board shall also have the power to refer the parties in dispute to mediation.
PENALTIES
The DPDPA prescribes varying amounts of penalties based on the contraventions under the Act. A data fiduciary may be fined upto INR 250 crores for failure to implement security safeguards, upto INR 200 crores for failure to provide notice of a data breach, and failure to comply with the requirements for processing children’s data. Significant data fiduciaries may be fined up to INR 150 crores for failure to meet the additional obligations imposed on them, and a penalty of up to INR 50 crores has been prescribed for a breach of any other provision of the DPDPA or any rule issued under it.
The DPDPA also sets out general parameters that may be considered to determine the quantum of penalty such as the nature, gravity, and duration of the contravention, types of personal data affected, implications of the contravention, and mitigating measures adopted by the contravening party.
Damages?
Under Section 43A of the IT Act, a company breaching its obligations in respect of personal data was liable to pay compensation to the person affected by such breach. While the DPDPA effectively repeals the applicability of the IT Act in relation to matters governing personal data, it does not make any provisions to ensure compensation for the data principals who may suffer from non-compliance of a data fiduciary.
Although the Board has been granted extensive powers to issue any directions it considers necessary to effectively discharge its functions under the DPDPA[23], it is unclear whether such powers would extend to grant of compensation to data principals.
CONCLUSION
With the development of technology at an unprecedented rate, the DPDPA marks a necessary advancement in technology and data privacy laws in India. However, the DPDPA is lean covering only the substantive requirements, with significant details e.g., restriction on cross-border transfers, details surrounding a data breach notice, and time period for grievance redressal, being left open to rulemaking. For now, it seems that the law will evolve further only after additional rules are officially notified.
Authors: Anushka Iyer, and Shantanu Mukherjee.
References:
[1] The Digital Personal Data Protection Act, 2023, (No. 22 of 2023), https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf.
