New Delhi, Nov. 20 -- The Digital Personal Data Protection (DPDP) Act, 2023, yet to be implemented, is a statute designed for the digital age. Once its provisions come into effect, the DPDP Act will replace Section 43A of the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data of Information) Rules, 2011.

The statute regulates the processing of digital personal data in a way that balances individuals' right to protect their personal data with the need for lawful data processing and matters connected therewith or incidental thereto.

By prioritising privacy and security, the DPDP Act seeks to establish a framework that inter alia addresses the challenges of data handling in the modern digital age. It grants data principals-those whose data is stored-specific data privacy rights, which data fiduciaries, or entities storing data, must respect. Under the Act, data fiduciaries may process personal data only in accordance with its provisions and for lawful purposes for which the data principal has given consent or for certain legitimate uses. Non-compliance by data fiduciaries may result in penalties.

As per Section 7, a data fiduciary may process a data principal's personal data for the specified purpose for which the data was voluntarily provided, provided the data principal has not explicitly indicated a lack of consent for its use. Consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. It must also signify agreement to process personal data solely for the specified purpose and be limited to the data necessary for that purpose.

The Act mandates that data fiduciaries erase personal data unless its retention is required by law. This erasure must occur upon the data principal withdrawing consent, as part of the fiduciary's general obligations, or when it is reasonable to assume the specified purpose is no longer being served, whichever comes first. Data fiduciaries are also obligated to maintain data security and fulfill various other duties outlined in the Act.

Data principals have the right to access their personal data held by data fiduciaries, including details such as the source of the data, the purpose of processing, and the categories of data recipients. They are also entitled to correct, complete, update, or erase their personal data for which they had previously given consent. Upon receiving a request for correction, completion, or updating, data fiduciaries must promptly rectify any inaccurate or misleading information.

The statute states that a Data Fiduciary shall, before processing any personal data of a child or a person with a disability who has a lawful guardian, obtain verifiable consent from the parent of such child or the lawful guardian, in a manner prescribed by law. Data Fiduciaries are prohibited from processing personal data in a manner likely to cause any detrimental effect on the well-being of a child, along with other stipulated restrictions.

Activities related to India's sovereignty, security, and public order, as well as research or statistical purposes, are exempted. The Act also grants the government the authority to introduce additional exemptions.

Under Section 18 of the Act, the Data Protection Board of India, an adjudicating body, will be established. The Board is intended to function as an impartial adjudicatory body responsible for resolving privacy-related grievances and disputes. The Central Government will appoint the Board's members, and its decisions can be appealed before the Appellate Authority. The Act references the Telecom Regulatory Authority of India Act, 1997, in its provisions on appeals, with the authority for such appeals resting with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

The promulgation of the DPDP Act follows the landmark case 'Justice KS Puttaswamy vs. Union of India', where the Supreme Court of India recognised the fundamental right to privacy. In the current era of artificial intelligence, the Act is a necessity.

The writer is a practising Advocate in Supreme Court and High Court of Delhi. Views expressed are personal

Published by HT Digital Content Services with permission from Millennium Post.