Have a Question About the DPDP Act?

Under Section 2(i) of the DPDP Act, 2023, a Data Fiduciary means any person, company, firm, or entity that alone or in conjunction with other persons determines the purpose and means of processing personal data. The Data Fiduciary bears the primary legal accountability for statutory compliance, ensuring valid consent, giving notices, maintaining data accuracy, implementing reasonable security safeguards, and addressing Data Principal grievances.

Under Section 5, before or at the time of seeking consent, the Data Fiduciary must give the Data Principal an itemized notice stating: (1) The specific personal data to be collected; (2) The specific purpose for which it will be processed; (3) The manner in which the Data Principal may exercise their rights of access, correction, and erasure; (4) The manner of making a grievance to the Data Fiduciary; and (5) The procedure to make a complaint to the Data Protection Board of India. Notice must be available in English or any of the 22 languages specified in the Eighth Schedule to the Constitution.

The DPDP Act guarantees Data Principals four primary rights: (1) Right to Access: To obtain a summary of personal data being processed, processing activities, and identities of Data Fiduciaries/Processors with whom data has been shared (Section 11); (2) Right to Correction & Erasure: To correct inaccurate data, update incomplete records, and request deletion when the purpose is completed (Section 12); (3) Right of Grievance Redressal: To have grievances resolved by the Data Fiduciary within prescribed timelines (Section 13); and (4) Right to Nominate: To nominate an individual to exercise rights in the event of death or incapacity (Section 14).

The Central Government may designate any Data Fiduciary as a Significant Data Fiduciary (SDF) based on factors such as: volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, and public order. SDFs must comply with additional statutory mandates: appoint an India-based Data Protection Officer (DPO), engage an independent Data Auditor, conduct periodic Data Protection Impact Assessments (DPIA), and institute periodic audits.

Under Section 9, a child is defined as any individual under 18 years of age. Before processing personal data of a child, a Data Fiduciary must obtain verifiable consent of the parent or lawful guardian. Additionally, Data Fiduciaries are strictly prohibited from: (1) Processing personal data that is likely to cause any detrimental effect on the well-being of a child; (2) Undertaking tracking or behavioral monitoring of children; and (3) Directing targeted advertising towards children. Breach of Section 9 carries penalties up to ₹200 Crore.

The Data Protection Board of India has statutory powers to levy substantial financial penalties: Up to ₹250 Crore for failure to implement reasonable security safeguards resulting in a data breach; Up to ₹200 Crore for failure to notify the Board and affected users of a breach; Up to ₹200 Crore for non-compliance with child data obligations; Up to ₹150 Crore for SDF violations; and Up to ₹50 Crore for general non-compliance.

Under Section 6(4), the Data Principal has the right to withdraw their consent at any time. The ease of withdrawing consent must be comparable to the ease with which consent was originally given. Once consent is withdrawn, the Data Fiduciary and any Data Processors must cease processing the personal data within a reasonable time, unless retention is mandated by law. Withdrawal does not affect the legality of processing carried out prior to withdrawal.

A Consent Manager is an interoperable entity registered with the Data Protection Board of India that acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and secure electronic interface.

Section 17 provides targeted exemptions: (1) Processing for enforcement of legal rights or claims; (2) Processing by courts, tribunals, or judicial authorities; (3) Prevention, investigation, or prosecution of any offence; (4) Non-resident data processed in India under international contracts; (5) Mergers, demergers, and corporate reorganisations; and (6) Processing for research, archiving, or statistical purposes without using data to make specific decisions regarding the Data Principal.

Under Section 8(6), in the event of a personal data breach, the Data Fiduciary must give intimation of such breach to the Data Protection Board of India and each affected Data Principal in such form and manner as prescribed under the upcoming DPDP Rules. Failure to notify carries a penalty of up to ₹200 Crore.