Digital Personal Data Protection Act, 2023 (DPDP Act) Legal Counsel & Corporate Privacy Advisory

1. Executive Overview: India's Definitive Privacy Era Under the DPDP Act 2023

The enactment of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) marks a profound paradigm shift in India's technology jurisprudence. Replacing the antiquated Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the DPDP Act establishes a modern, rights-centric legal framework governing the collection, storage, processing, and transfer of digital personal data.

The Act applies to the processing of digital personal data within the territory of India where such data is collected in digital form or digitized subsequently. Crucially, under Section 3(b), it applies extraterritorially to the processing of digital personal data outside the territory of India if such processing is in connection with any activity related to the offering of goods or services to Data Principals within India.

With the establishment of the Data Protection Board of India (DPBI) and statutory monetary penalties reaching up to ₹250 Crores per violation, enterprises can no longer treat privacy as a check-the-box paper exercise. Advocate Ritik Khurana provides specialized statutory guidance to technology platforms, financial institutions, healthcare providers, and multinational corporations to insulate operations from regulatory enforcement.

2. Architectural Taxonomy: Data Fiduciaries vs. Significant Data Fiduciaries

The statutory framework establishes a clear demarcation of organizational roles and responsibilities:

• Data Principal (Section 2(j)): The individual to whom the personal data relates, including the parent or lawful guardian in the case of a child or person with disability.
• Data Fiduciary (Section 2(i)): Any person who alone or in conjunction with other persons determines the purpose and means of processing personal data. Fiduciaries bear primary legal liability under the Act.
• Data Processor (Section 2(k)): Any person who processes personal data on behalf of a Data Fiduciary. Processors may only be engaged under a valid, written contract (Data Processing Agreement).
• Significant Data Fiduciary (SDF) (Section 10): The Central Government is empowered to designate any Data Fiduciary or class of Data Fiduciaries as Significant based on an assessment of relevant factors including volume and sensitivity of data processed, risk to the rights of Data Principals, sovereignty and integrity of India, risk to electoral democracy, and public order.

Entities designated as Significant Data Fiduciaries face heightened compliance requirements:

1. Appointment of a Data Protection Officer (DPO): The DPO must be based in India, serve as the point of contact for grievance redressal, and report directly to the Board of Directors or governing body.
2. Independent Data Auditor: Mandatory engagement of an external, independent data auditor to evaluate compliance with statutory mandates.
3. Data Protection Impact Assessments (DPIA): Periodic formal assessments evaluating systemic risks, purpose limitation, data minimization, and mitigation measures prior to deploying novel processing technologies.

3. The Notice & Consent Mandate: Section 5 & 6 Statutory Architecture

Consent under the DPDP Act must be free, specific, informed, unconditional, and unambiguous, accompanied by an affirmative action signifying agreement to the processing of personal data for a specified purpose. Any part of consent that infringes the provisions of the Act or any other law is rendered void to the extent of such infringement.

Under Section 5, every consent request must be preceded or accompanied by a formal statutory notice setting out:

• The specific categories of personal data sought to be collected.
• The precise, itemized purpose for which the personal data will be processed.
• The manner in which the Data Principal may exercise rights of withdrawal of consent and grievance redressal.
• The contact details of the Data Protection Officer or designated representative.
• The option to access the notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India (including Hindi, Punjabi, Bengali, Tamil, Telugu, Marathi, and Gujarati).

Furthermore, the Act formally establishes the institution of Consent Managers (Section 6(7)–(9)). A Consent Manager is an interoperable entity registered with the Data Protection Board that enables a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and secure digital interface.

4. Special Protections for Children & Persons with Disabilities (Section 9)

Section 9 of the DPDP Act introduces strict statutory safeguards governing the processing of personal data belonging to children (defined as individuals who have not completed 18 years of age) and individuals with disabilities:

• Verifiable Parental Consent: A Data Fiduciary must obtain verifiable consent of the parent or lawful guardian prior to processing any personal data of a child.
• Prohibition of Detrimental Processing: Fiduciaries are strictly prohibited from undertaking any processing of personal data that is likely to cause any detrimental effect on the physical or psychological well-being of a child.
• Categorical Bar on Tracking & Targeted Ads: The Act prohibits tracking, behavioral monitoring, or targeted advertising directed at children. Platforms deploying recommender algorithms or engagement metrics targeting minors face severe statutory penalties of up to ₹200 Crores under the Schedule.

5. Cross-Border Personal Data Transfers (Section 16)

Section 16 of the DPDP Act adopts a modern "negative list" or blacklisting approach to cross-border data flows. The Central Government may restrict the transfer of personal data by a Data Fiduciary for processing to such countries or territories outside India as may be formally notified.

However, Section 16(2) explicitly preserves the supremacy of any other sectoral law that provides for a higher degree of protection or restriction on data transfer. Consequently, Indian enterprises must continually align cross-border data transfer agreements with:

• Reserve Bank of India (RBI) Payment Data Localisation Directives: Mandatory storage of complete end-to-end payment transaction data within systems situated solely in India.
• IRDAI Insurance Data Regulations: Restrictions on offshore hosting of policyholder sensitive health and financial records.
• Securities and Exchange Board of India (SEBI) Cloud Framework: Strict localization of broker-dealer algorithmic and transaction data.

6. Data Breach Response: CERT-In 6-Hour Reporting vs. DPBI Notification

When a personal data breach occurs, corporate legal teams must coordinate a harmonized dual-track reporting strategy:

Under Section 8(6) of the DPDP Act, upon becoming aware of a personal data breach, the Data Fiduciary is under a mandatory statutory obligation to notify the Data Protection Board of India and each affected Data Principal in such form and manner as prescribed. Failure to notify incurs statutory penalties up to ₹200 Crores.

Simultaneously, under the CERT-In Directions (April 28, 2022) issued pursuant to Section 70B(6) of the IT Act 2000, cybersecurity incidents—including unauthorized access to IT systems, identity theft, data breaches, and ransomware outbreaks—must be reported to CERT-In within 6 hours of noticing or being brought to notice of the incident.

Our chambers draft corporate Incident Response Protocols (IRP), coordinate digital forensic preservation under Section 63 Bharatiya Sakshya Adhiniyam (BSA) 2023, and represent corporations in breach hearings before the Board.

7. Data Protection Board of India (DPBI) Adjudication & Penalties

The Data Protection Board of India functions as a quasi-judicial body with the powers of a civil court. Under Section 27 and 28, the Board is empowered to conduct inquiries, summon witnesses, inspect digital evidence, and issue binding orders and penalties.

The statutory penalties under the Schedule are severe and non-fault dependent:

• Failure to take reasonable security safeguards (Section 8(5)): Up to ₹250 Crores.
• Failure to notify personal data breach (Section 8(6)): Up to ₹200 Crores.
• Breach of Section 9 child data obligations: Up to ₹200 Crores.
• Breach of Significant Data Fiduciary obligations: Up to ₹150 Crores.
• General non-compliance with statutory provisions: Up to ₹50 Crores.

Appeals against any order or direction of the Board lie before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29, and subsequently before the Supreme Court of India under Section 31.

8. Corporate DPDP Act Audit & Implementation Roadmap

Our chambers execute an exhaustive six-stage compliance roadmap:

1. Data Discovery & ROPA: Mapping personal data assets across cloud repositories, enterprise software, third-party APIs, and archival systems to build a comprehensive Record of Processing Activities.
2. Consent Architecture Redesign: Drafting multilingual notices in English and scheduled Indian languages, integrating Consent Manager APIs, and restructuring opt-in UX to eradicate dark patterns.
3. Vendor & Processor Contracting: Overhauling Data Processing Agreements (DPAs) with mandatory audit rights, breach notification covenants, and back-to-back indemnity protections.
4. Data Principal Rights (SRR) Workflows: Instituting automated mechanisms for processing Data Principal requests for access, correction, completion, updating, erasure, and grievance redressal within statutory deadlines.
5. Technical Security Safeguards: Implementing enterprise encryption at rest and in transit, multi-factor authentication, role-based access control (RBAC), and zero-trust perimeter defenses.
6. Mock Breach Simulations & DPO Training: Conducting tabletop crisis exercises to test the 6-hour CERT-In escalation protocol and Board notification workflows.

Frequently Asked Questions: DPDP Act Compliance