Explanation:
The Digital Personal Data Protection Act (DPDP Act), 2023 is a landmark piece of legislation that primarily deals with the regulation of digital personal data processing in India. Enacted on August 11, 2023, it replaces the outdated Section 43A of the Information Technology Act, 2000, and establishes a comprehensive framework to protect individual privacy while acknowledging the necessity of processing personal data for lawful purposes. Following is a detailed point-wise discussion of the key areas regulated by the Act. 1. Scope and Applicability The Act specifically focuses on "digital" data, distinguishing it from purely physical records. Material Scope: It applies to personal data collected in digital form or data collected offline and subsequently digitized. It does not apply to non-digital (paper) records unless they are scanned or entered into a system. Territorial Reach: The Act applies to the processing of data within India. Critically, it also has extraterritorial application: it applies to entities outside India if they process the personal data of Indian residents to offer goods or services in India. Exclusions: It does not cover data processed for personal or domestic purposes (e.g., a family photo album) or data made publicly available by the individual themselves (e.g., a public social media post). 2. The Core Triad: Principal, Fiduciary, and Processor The Act regulates the relationships between three primary stakeholders: Data Principal: The individual to whom the personal data relates (the citizen). Data Fiduciary: The entity (company, government, or individual) that determines the purpose and means of processing. This is the party primarily responsible for compliance. Data Processor: Any person or entity that processes data on behalf of a Data Fiduciary. 3. Grounds for Data Processing The DPDP Act mandates that data can only be processed for a lawful purpose under two specific conditions: Consent: Processing must be based on "free, specific, informed, unconditional, and unambiguous" consent. Individuals must be given a clear notice in plain language (and in any of the 22 languages specified in the Eighth Schedule of the Constitution) explaining what data is being collected and why. Legitimate Uses: Data may be processed without explicit consent for certain "legitimate uses," such as: Voluntary sharing of data for a specific purpose. Fulfilling government subsidies or services. Medical emergencies or public health safety. Employment-related purposes.