India DPDP Act explained for foreign businesses
India DPDP Act is the short name for the Digital Personal Data Protection Act, 2023, India's first national law on personal data. It became law on August 11, 2023. If your firm handles data about people in India, it may apply to you even when your office is abroad. Here is what it says, what you should do now, and what is not yet settled.
What the law is and where it stands
Parliament passed the bill in August 2023. The Lok Sabha voted on August 7, and the Rajya Sabha voted on August 9. The President gave assent on August 11, 2023. The law is Act No. 22 of 2023.
Passing a law is not the same as enforcing it. The Act leaves many details to rules that the central government must still write. As of today, those rules have not been issued, and the duties have not been switched on in full. Plan for the law, but do not expect fines tomorrow. This is general information, not legal advice.
Sources: Wikipedia, "Digital Personal Data Protection Act, 2023" (assent date and Act number); PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023 (passage dates). The point about rules still to come is the editors' reading of the Act.
Who it covers
The Act covers digital personal data. That means data collected online, or collected on paper and then turned into digital form. It covers any firm that decides why and how the data is used. The Act calls that firm a data fiduciary. The person the data is about is a data principal.
It also reaches firms outside India. If you process data outside the country in order to offer goods or services to people in India, the Act applies. A foreign online shop, software company or app that sells to Indian customers should read it closely.
Sources: PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023.
Core duties for your business
The Act sets a short list of duties. Most firms will meet them through plain, steady habits.
First, get consent for a clear, lawful purpose, and give the person a notice before you use their data. The Act lists a few legitimate uses where consent is not needed. Examples are data a person shares voluntarily, government benefits, medical emergencies and employment.
Second, keep the data accurate and complete. Third, put reasonable security safeguards in place to prevent a breach. Fourth, if a breach happens, tell the Data Protection Board and the people affected. Fifth, erase the data once the purpose is met and no law requires you to keep it.
Write these five duties into a simple checklist. Then match each one to a real process in your company, with a named owner.
Sources: PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023.
Rights of people and rules for children
People in India get rights under the Act. They can ask for information about how their data is used. They can ask you to correct or erase it. They can withdraw consent at any time. They can use a grievance process, and they can name another person to act for them if they die or cannot act themselves.
Children get extra care. The Act treats anyone under 18 as a child. You need the consent of a parent or legal guardian before you handle a child's data. You must also avoid processing that harms a child's well-being. The Act does not spell out what counts as harm, so expect more detail later.
If your product is used by teenagers in India, check your sign-up flow now. Ask how you would prove a parent said yes.
Sources: PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023.
Penalties and the Board
The central government sets up the Data Protection Board of India. The Board checks compliance, orders steps after a breach, hears complaints and can impose penalties after an inquiry. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal.
The penalties are large. A failure to take security measures against a breach can bring a penalty of up to Rs 250 crore. A failure to meet the duties for children can bring up to Rs 200 crore. Other maximums sit in a schedule to the Act. A person who breaks the duties of a data principal, such as giving false details, can face up to Rs 10,000.
These are maximums, not fixed fees. The Board decides each case.
Sources: PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023.
What is still unclear, and what to do now
Three open points matter most. The rules are not yet issued, so forms of notice and consent are not fixed. The date the main duties begin has not been announced. The Act also lets the government restrict transfers of data to named countries, and no list exists yet. Until one does, transfers abroad are allowed.
Meanwhile, you can prepare in five steps. Map what personal data you hold on people in India. Draft a clear notice in plain language. Review your security controls. Write a breach plan that names who tells the Board. Set a retention rule so old data is erased on time.
Check the official Gazette of India for the Act's text, and watch the Ministry of Electronics and Information Technology for the rules. Speak to a qualified Indian lawyer before you make decisions.
Sources: PRS Legislative Research, bill page for the Digital Personal Data Protection Bill, 2023 (transfer provision). The status of rules and the preparation steps are the editors' own reading and suggestions.
Sources
- Government of India, The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Gazette of India, August 11, 2023.
- PRS Legislative Research, "The Digital Personal Data Protection Bill, 2023," prsindia.org.
- Wikipedia, "Digital Personal Data Protection Act, 2023."