ANALYSYS OF -DIGITAL PERSONAL DATA PROTECTION ACT, 2023
ANALYSYS OF -DIGITAL PERSONAL DATA PROTECTION ACT, 2023
Notification No.: CG-DL-E-12082023-248045
Dated ; 11th August, 2023
Dear Friends,
As you are aware that “ Data” is now treated as an asset today and refer to a system, application output file, document, database, or web page that companies use to generate revenues. Data is the most valuable asset in this technology era and entities are spending huge amount to collect , generate and protect data. The business entities generate their revenue by exploiting data ,which makes their products or services unique in the market. So data is the most valuable assets for any organisation.
Data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means. Data can be of various types and related to various persons and aspects, such as personal data of persons, scientific data, data related to patients, people, their race , caste, creed, data related to economic , finance etc. and of course data collected by social media platforms of their users.
We have seen various data breaches and sale of personal data by various data collecting firms for monetary benefits. Data of persons suffering from specific disease , details of customers admitting in hospitals for ailment generally traded by hospital staffs with various insurance and medical companies. Data related to financial and economic credibility of persons and traded by credit agencies, even some employees of banks are traded data of their customers.
Since banks and other financial institutions generally outsourced their activities to third parties such as implementation of IT System to serve customer better, collection of KYC documents, collection of premium in case of insurance companies, handling of various types of sale of products through insurance intermediaries , pose threat on protection of personal data of customers and policyholders.
It is necessary to protect and prohibit misuse of personal data and to penalise those who are misusing available personal data with them in the interest of customers and policyholders,
The government in endeavour to protect personal data after Hon’ble Supreme Court decision for declaration of “ Right to Privacy” as a fundamental right in August, 2017 formed a committee under Chairmanship of Justice Shrikrishna to suggest and frame act for protection of personal data and committee had submit its report along with draft of Personal Data Protection Act, 2018. In December ,2019 the draft of PDP Act,2019 was referred to JCP of the Parliament. The JCP issue its report and proposed new version of Data Protection Act. Ministry of Electronics and Information Technology (MeitY) releases draft Digital Personal Data Protection Bill (DPDPB) for public consultation in November, 2022. Union Cabinet approved the draft DPDP Bill, 2023. In August 2023 the DPDP Act, 2023 came into effect after getting approval of the President.
The Ministry of Law and Justice has brought DPDP Act, 2023 ( Digital Personal Data Protection Act, 2023) on 11th August 2023.
The Act applies to personal data that is collected in digital form or non digital form but in process of digitisation or digitised subsequently.
The DPDP Act contains a more limited concept of privacy notices. Where a data fiduciary needs to rely on consent to process personal data, that consent should be free, specific, informed, unconditional and unambiguous. Companies should seek such consent by way of a clear and itemised notice and request for consent, to be made available in all the 22 languages mentioned in the 8th schedule of the Indian Constitution.
The contents of that notice may be further elaborated in subsequent rules but based on the DPDP Act it is unlikely to need details of any data protection officer, further recipients of the personal data, period of retention, etc. as needed under the GDPR.
APPLICABILIT
Processing of digital and digitized personal data
► Processing of personal data within the territory of India and outside India
► Activity related to offering goods and services to Data Principals within India
Not Apply to
► Processing for domestic or personal purposes by individuals
► Personal data made publicly available
DEFINITIONS: SECTION 2
(g) “Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;
(h) “data” means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means;
(i) “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
(j) “Data Principal” means the individual to whom the personal data relates and where such individual is— (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf;
(k) “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary;
(l) “Data Protection Officer” means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10;
(o) “gain” means—
(i) a gain in property or supply of services, whether temporary or permanent; or
(ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration;
(p) “loss” means—
(i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration;
(s) “person” includes—
(i) an individual;
(ii) a Hindu undivided family;
(iii) a company;
(iv) a firm;
(v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and
(vii) every artificial juristic person, not falling within any of the preceding sub-clauses;
(t) “personal data” means any data about an individual who is identifiable by or in relation to such data;
(u) “personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;
(x) “processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction;
(z) “Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10;
(za) “specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder.
APPLICATION OF ACT- SECTION 3- Subject to the provisions of this Act, it shall—
(a) apply to the processing of digital personal data within the territory of India where the personal data is collected––
(i) in digital form; or
(ii) in non-digital form and digitised subsequently;
(b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;
(c) not apply to—
(i) personal data processed by an individual for any personal or domestic purpose; and
(ii) personal data that is made or caused to be made publicly available by—
(A) the Data Principal to whom such personal data relates; or
(B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
GROUNDS OF PROCESSING PERSONAL DATA- SECTION 4
(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.
NOTICE TO CONCENT SECTION 5
(1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,—
- the personal data and the purpose for which the same is proposed to be processed;
- the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
- the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.
(2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,—
(a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,––
(i) the personal data and the purpose for which the same has been processed;
(ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and
(iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.
(b) the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.
(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.
Example: suppose Mr. A has taken a policy through online mode from an insurance company’s website and chooses online KYC verification. In this case while completing KYC requirements insurance company shall inform Mr. A the purpose of collection of data and utilisation of the same in issue of insurance policy. It is necessary to inform and take consent of Data Principal before processing of personal data.
Example: in above given case Mr. A being data principal can withdraw his consent for use of his personal data and in this case insurance company has not right to use data further. Insurance company shall use personal data till the consent withdrawn by Mr. A.
CONSENT OF DATA PRINCIPAL -SECTION 6
(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act, or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act.
(4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal.
(6) If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India.
(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.
(8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed.
(9) Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.
(10) Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.
Example: X, a telecom service provider, enters into a contract with Y, a Data Processor, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processing of her personal data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processing of the personal data of Z for emailing bills.
DATA FIDUCIARY SECTION 7
A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:—
(a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data.
Examples 1: X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt.
Examples 2: X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X.
(b) for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where––
- She has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or
- Such personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data.
Example: X. a pregnant woman, enrols herself on an app or website to avail of government’s maternity benefits programme, while consenting to provide her personal data for the purpose of availing of such benefits. Government may process the personal data of X processing to determine her eligibility to receive any other prescribed benefit from the government.
(c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State;
(d) for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force;
(e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India;
(f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual;
(g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health;
(h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order.
Explanation.—For the purposes of this clause, the expression “disaster” shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005; or (i) for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.
GENERAL OBLIGATIONS OF DATA FIDUCIARY- SECTION 8
(1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor.
(2) A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract.
(3) Where personal data processed by a Data Fiduciary is likely to be—
(a) used to make a decision that affects the Data Principal; or
(b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its completeness, accuracy and consistency.
(4) A Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.
(5) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.
(6) In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
(7) A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,—
(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and
(b) cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor.
(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data Principal does not––
(a) approach the Data Fiduciary for the performance of the specified purpose; and
(b) exercise any of her rights in relation to such processing, for such time period as may be prescribed, and different time periods may be prescribed for different classes of Data Fiduciaries and for different purposes.
(9) A Data Fiduciary shall publish, in such manner as may be prescribed, the business contact information of a Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary, the questions, if any, raised by the Data Principal about the processing of her personal data.
(10) A Data Fiduciary shall establish an effective mechanism to redress the grievances of Data Principals.
(11) For the purposes of this section, it is hereby clarified that a Data Principal shall be considered as not having approached the Data Fiduciary for the performance of the specified purpose, in any period during which she has not initiated contact with the Data Fiduciary for such performance, in person or by way of communication in electronic or physical form.
Example: X, an individual, decides to close her savings account with Y, a bank. Y is required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X’s personal data for the said period.
PLEASE NOTE THAT: Data Fiduciary shall erase the personal data of the Data Principal after completion of work for which Personal Data acquired, unless there be any statutory requirement or unless law mandate to keep data for certain period of time. As in the case of bank account ,once Data Principal closed account , the relationship between bank and principal ends, in this case bank shall erase data but as per banking law , data should be kept for at least 10 years. In this case bank shall keep data.
PROCESSION OF DATA OF CHILDREN SECTION 9.
(1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.
(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.
(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.
PLEASE NOTE THAT: consent of parent or appointed guardian of children shall be taken while processing of data of child. In case child become major , the data fiduciary shall take consent of child for further processing of data available with it.
ADDITIONAL OBLIGATIONS OF SIGNIFICANT DATA FIDUCIARY- SECTION 10
(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including—
(a) the volume and sensitivity of personal data processed;
(b) risk to the rights of Data Principal;
(c) potential impact on the sovereignty and integrity of India;
(d) risk to electoral democracy;
(e) security of the State; and
(f) public order.
(2) The Significant Data Fiduciary shall—
(a) appoint a Data Protection Officer who shall—
(i) represent the Significant Data Fiduciary under the provisions of this Act;
(ii) be based in India;
(iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and
(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
(b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and
(c) undertake the following other measures, namely:—
(i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;
(ii) periodic audit; and
(iii) such other measures, consistent with the provisions of this Act, as may be prescribed.
RIGHTS AND DUTIES OF DATA PRINCIPAL SECTOR 11.
(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—
(a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
(b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
(c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
(2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.
RIGHT TO CORRECTION AND ERASURE OF PERSONAL DATA- SECTION 12;
(1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.
(2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal,—
(a) correct the inaccurate or misleading personal data;
(b) complete the incomplete personal data; and
(c) update the personal data.
(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.
RIGHT TO GRIEVANCE REDRESSAL- SECTION 13
(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.
(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.
(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
RIGHT TO NOMINATE -SECTION 14
(1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.
(2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.
DUTIES OF DATA PRINCIPAL- SECTION 15
A Data Principal shall perform the following duties, namely:—
(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
(b) to ensure not to impersonate another person while providing her personal data for a specified purpose;
(c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
(d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
(e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.
PROCESSING OF PERSONAL DATA OUTSIDE INDIA- SECTION 16
(1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
(2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
EXEMPTIONS
(1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where—
(a) the processing of personal data is necessary for enforcing any legal right or claim;
(b) the processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function; (c) personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;
(d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India;
(e) the processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force; and
(f) the processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.
(2) The provisions of this Act shall not apply in respect of the processing of personal data— (a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and
(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.
(3) The Central Government may, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including startups, as Data Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply.
Explanation.—For the purposes of this sub-section, the term “startup” means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to startups are allocated in the Central Government.
(4) In respect of processing by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processing is for a purpose that does not include making of a decision that affects the Data Principal, sub-section (2) of section 12 shall not apply.
(5) The Central Government may, before expiry of five years from the date of commencement of this Act, by notification, declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification.
SUMMERY: Consent is not expressly needed for situations such as
► Voluntary disclosure by data principal
► Reasonable expectation by data principal
► Performance of function under the law
► Medical emergency among others
► Compliance with any judgment issued under any law
► Threat to public health
► Ensure safety in case of any disaster
CHAPTER V DATA PROTECTION BOARD OF INDIA- SECTION 18
(1) With effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India.
(2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.
(3) The headquarters of the Board shall be at such place as the Central Government may notify.
SUMMERY The Central Government may, by notification shall appoint and establish, an independent board to be called the Data Protection Board of India (Board).
► This Board should consist of a chairperson and other members, who should be appointed by the Central Government.
► The Board is entrusted with the task of enforcement, including determining non-compliances, imposing penalties, issuing directions and mediation (to resolve dispute between parties) to ensure compliance with the law.
► The Board is enshrined with powers of a civil court and appeals against its decisions lie to Telecom Disputes Settlement and Appellate Tribunal
CHAPTER VI
POWERS, FUNCTIONS AND PROCEDURE TO BE FOLLOWED BY BOARD -SECTION 27.
(1) The Board shall exercise and perform the following powers and functions, namely:—
(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;
(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;
(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.
PROCEDURE TO BE FOLLOWED BY BOARD – SECTION 28
(1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed.
(2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder. Powers of Chairperson. Powers and functions of Board. Procedure to be followed by Board.
(3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry.
(4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.
(5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act.
(6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.
(7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to—
(a) summoning and enforcing the attendance of any person and examining her on oath;
(b) receiving evidence of affidavit requiring the discovery and production of documents;
(c) inspecting any data, book, document, register, books of account or any other document; and
(d) such other matters as may be prescribed.
(8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person.
(9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.
(10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard.
(11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.
(12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.
CHAPTER VII
APPEAL AND ALTERNATE DISPUTE RESOLUTION-SECTION 29
(1) Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal.
(2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed.
(3) The Appellate Tribunal may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period.
(4) On receipt of an appeal under sub-section (1), the Appellate Tribunal may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against.
(5) The Appellate Tribunal shall send a copy of every order made by it to the Board and to the parties to the appeal.
(6) The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it.
(7) Where any appeal under sub-section (6) could not be disposed of within the period of six months, the Appellate Tribunal shall record its reasons in writing for not disposing of the appeal within that period.
(8) Without prejudice to the provisions of section 14A and section 16 of the Telecom Regulatory Authority of India Act, 1997, the Appellate Tribunal shall deal with an appeal under this section in accordance with such procedure as may be prescribed.
(9) Where an appeal is filed against the orders of the Appellate Tribunal under this Act, the provisions of section 18 of the Telecom Regulatory Authority of India Act, 1997 shall apply.
(10) In respect of appeals filed under the provisions of this Act, the Appellate Tribunal shall, as far as practicable, function as a digital office, with the receipt of appeal, hearing and pronouncement of decisions in respect of the same being digital by design.
ORDERS PASSED BY APPELLATE TRIBUNAL TO BE EXECUTABLE AS DECREE- SECTION 30
(1) An order passed by the Appellate Tribunal under this Act shall be executable by it as a decree of civil court, and for this purpose, the Appellate Tribunal shall have all the powers of a civil court.
(2) Notwithstanding anything contained in sub-section (1), the Appellate Tribunal may transmit any order made by it to a civil court having local jurisdiction and such civil court shall execute the order as if it were a decree made by that court.
ALTERNATE DISPUTE RESOLUTION SECTION 31
If the Board is of the opinion that any complaint may be resolved by mediation, it may direct the parties concerned to attempt resolution of the dispute through such mediation by such mediator as the parties may mutually agree upon, or as provided for under any law for the time being in force in India.
VOLUNTRY UNDERTAKING SECTION 32
(1) The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28.
(2) The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking.
(3) The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking.
(4) The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).
(5) Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33.
CHAPTER VIII
PENALTIES AND ADJUDICATION -SECTION 33.
(1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.
(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:—
(a) the nature, gravity and duration of the breach;
(b) the type and nature of the personal data affected by the breach;
(c) repetitive nature of the breach;
(d) whether the person, as a result of the breach, has realised a gain or avoided any loss;
(e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
(f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
(g) the likely impact of the imposition of the monetary penalty on the person. 34. All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India.
SUMMERY
- Breach in observance of duty of Data Principal- Rs. 10,000/-
- Breach in observance of additional obligation in relation to children- Rs. 200 Cr.
- Breach in not giving notice of Personal Data Breach- Rs. 200 Cr
- Noncompliance of the provisions by Data Fiduciaries- Rs. 250 Cr.
SECTION 34-All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India.
BAR OF JURISDICTION SECTION 39 –No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act.
AMENDMENTS TO PREVAILING LAWS:
Existing IT Act, 2000 and Right to Information Act 2005 are amended as following:
- Article 43(A) (Compensation for failure to protect data) of IT Act 2000 is omitted.
- Section 8 (1)(j) RTI Act 2005 is amended to exempt the personal information which allows disclosure for public interest.
SCHEDULE
PENALTIES ON CONTRAVENTION OF VARIOUS PROVISIONS OF ACT
| Sr. No. | Breach of provisions of this Act or rules made thereunder | Penalty (Rs.) |
| 1 | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2 | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3 | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4 | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to two hundred crore rupees. |
| 5 | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6 | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7 | Breach of any other provision of this Act or the rules made thereunder | May extend to fifty crore rupees. |
Below mentioned are the key differences between DPDPB 2023 and the General Data Protection Regulation (GDPR):
| General Data Protection Regulation (GDPR) | Digital Personal Data Protection (DPDP) Act, 2023 |
| GDPR applies to processing of Personal Data wholly or partly by automated means and to Personal Data which form or will form a part of a filing system. | Penalties under the DPDP Act extend up to INR250 crore. |
| Penalties under GDPR extend to 20 million euros, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher. | Children under the age of 18 need consent from parents/ guardian. |
| Minors under age 16 need parental consent. Members states of Europe can lower this age to 13 for their regions. | The Act does not specify a timeframe for Personal Data breach notification. |
| GDPR does not include right to nominate however provides for the right to portability Organizations have 30 days to respond to a Data Subject request. | The Act comprises of an additional right to nominate while omits the right to portability and timeline to respond to the Data Principal requests has not been specified. |
| GDPR lays down specific mechanisms for transferring data to third country such as standard contractual clauses and binding corporate rules. | The Act has not identified any transfer mechanisms for transferring Personal Data. |
| Both Controllers and Processors are under the obligation to appoint a DPO in specific circumstance. | Only the Significant Data Fiduciary shall have to appoint DPO as a point of contact for the Data Protection Board. |
| Data Controller and Data Processor are required to maintain the records of processing activities (ROPA). | The Act does not include any obligation for Data Fiduciaries to maintain records of processing activities (ROPA). |
| GDPR does not explicitly specify to provide notice to regional languages. | DPDP Act requires the Data Fiduciaries to provide notice in 22 Indian languages in addition to English. |
| Data Protection Impact Assessment (DPIA) is to be conducted by Data Controllers for all the high-risk processing activities. | Significant Data Fiduciaries are obligated to conduct periodic Data Protection Impact Assessment (DPIA). |
CONCLUSION: Personal Data or data related by any kind has become highly sensitive and vulnerable asset today. Data has become an asset for any entity and individuals. It is necessary to protect privacy and personal data of every individual. The Hon’ble Supreme Court of India has declared “ Right to privacy” should be treated as fundamental right of every individual. Implementation of new DPDP Act, 2023 is a right step of the government, it restrict and to the extent prohibit use of personal data without consent of data principal. The extent of penalty for any contravention is also kept high so that entity handling personal data deter to misuse data. The Act provides that if any data collected from data principal, same should be with her consent and the purpose should clearly declared or revealed. If data principal wants to stop use of data, she will intimate the same to the data fiduciary and data fiduciary shall stop use of personal data.
DISCLAIMER: article presented here is only for sharing information with readers. The views expressed are of personal nature, shall not be considered as professional advice. In case of necessity do consult with professional for more clarity and understanding on subject matter.
SOURCES: ey-india-dpdp-act-2023.pdf
Author: FCS DEEPAK P. SINGH[ B.Sc. LLB, FCS, AIII, CIAFP]
