TaxTMI 
TaxTMI 
Digital Personal Data Protection Act, 2023
X X X X Extracts X X X X
X X X X Extracts X X X X
....Gazette, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision. 2. Definitions. In this Act, unless the context otherwise requires,- (a) "Appellate Tribunal" means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997); (b) "automated" means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data; (c) "Board" means the Data Protection Board of India established by the Central Government under section 18; (d) "certain legitimate uses" means the uses referred to in section 7; (e) "Chairperson" means the Chairperson of the Board; (f) "child" means an individual who has not completed the age of eighteen years; (g) "Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withd....
X X X X Extracts X X X X
X X X X Extracts X X X X
....the State; and (vii) every artificial juristic person, not falling within any of the preceding sub-clauses; (t) "personal data" means any data about an individual who is identifiable by or in relation to such data; (u) "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data; (v) "prescribed" means prescribed by rules made under this Act; (w) "proceeding" means any action taken by the Board under the provisions of this Act; (x) "processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction; (y) "she" in relation to an individual includes the reference to such indiv....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... to be processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed. Illustration. X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing. (2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,- (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,-- (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the m....
X X X X Extracts X X X X
X X X X Extracts X X X X
....nt under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act. (4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given. (5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal. Illustration. X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processing of her ....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... to the Data Fiduciary that she does not consent to the use of her personal data. Illustrations. (I) X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt. (II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X; (b) for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where-- (i) she has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee. 8. General obligations of Data Fiduciary. (1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor. (2) A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract. (3) Where personal data processed by a Data Fiduciary is likely to be- (a) used to make a decision that affects the Data Principal; or (b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its comple....
X X X X Extracts X X X X
X X X X Extracts X X X X
....icable, or a person who is able to answer on behalf of the Data Fiduciary, the questions, if any, raised by the Data Principal about the processing of her personal data. (10) A Data Fiduciary shall establish an effective mechanism to redress the grievances of Data Principals. (11) For the purposes of this section, it is hereby clarified that a Data Principal shall be considered as not having approached the Data Fiduciary for the performance of the specified purpose, in any period during which she has not initiated contact with the Data Fiduciary for such performance, in person or by way of communication in electronic or physical form. 9. Processing of personal data of children. (1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed. Explanation.-For the purpose of this sub-section, the expression "consent of the parent" includes the consent of lawful guardian, wherever applicable. (2) A Data Fiduciary shall not undertake such processing of personal data that....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed; (ii) periodic audit; and (iii) such other measures, consistent with the provisions of this Act, as may be prescribed. CHAPTER III RIGHTS AND DUTIES OF DATA PRINCIPAL 11. Right to access information about personal data. (1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,- (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processin....
X X X X Extracts X X X X
X X X X Extracts X X X X
....h manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder. (2) For the purposes of this section, the expression "incapacity" means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body. 15. Duties of Data Principal. A Data Principal shall perform the following duties, namely:- (a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act; (b) to ensure not to impersonate another person while providing her personal data for a specified purpose; (c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities; (d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ubject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force. Explanation.- For the purposes of this clause, the expressions "default" and "financial institution" shall have the meanings respectively assigned to them in sub-sections (12) and (14) of section 3 of the Insolvency and Bankruptcy Code, 2016 (31 of 2016). Illustration. X, an individual, takes a loan from Y, a bank. X defaults in paying her monthly loan repayment instalment on the date on which it falls due. Y may process the personal data of X for ascertaining her financial information and assets and liabilities. (2) The provisions of this Act shall not apply in respect of the processing of personal data- (a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furni....
X X X X Extracts X X X X
X X X X Extracts X X X X
....uch number of other Members as the Central Government may notify. (2) The Chairperson and other Members shall be appointed by the Central Government in such manner as may be prescribed. (3) The Chairperson and other Members shall be a person of ability, integrity and standing who possesses special knowledge or practical experience in the fields of data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, or in any other field which in the opinion of the Central Government may be useful to the Board, and at least one among them shall be an expert in the field of law. 20. Salary, allowances payable to and term of office. (1) The salary, allowances and other terms and conditions of service of the Chairperson and other Members shall be such as may be prescribed, and shall not be varied to their disadvantage after their appointment. (2) The Chairperson and other Members shall hold office for a term of two years and shall be eligible for re-appointment. 21. Disqualifications for appointment and continuation as Cha....
X X X X Extracts X X X X
X X X X Extracts X X X X
....nt of a person acting as the Chairperson or other Member of the Board; or (c) any irregularity in the procedure of the Board, which does not affect the merits of the case. (3) When the Chairperson is unable to discharge her functions owing to absence, illness or any other cause, the senior-most Member shall discharge the functions of the Chairperson until the date on which the Chairperson resumes her duties. 24. Officers and employees of Board. The Board may, with previous approval of the Central Government, appoint such officers and employees as it may deem necessary for the efficient discharge of its functions under the provisions of this Act, on such terms and conditions of appointment and service as may be prescribed. 25. Members and officers to be public servants. The Chairperson, Members, officers and employees of the Board shall be deemed, when acting or purporting to act in pursuance of provisions of this Act, to be public servants within the meaning of section 21 of the Indian Penal Code (45 of 1860). 26. Powers of Chairperson. The Chairperson shall exercise the following powers, namely:- (a) general superintendence and giving directi....
X X X X Extracts X X X X
X X X X Extracts X X X X
....d under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect. 28. Procedure to be followed by Board. (1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed. (2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder. (3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry. (4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings. (5) In case the Board determines that there are sufficient grounds t....
X X X X Extracts X X X X
X X X X Extracts X X X X
....nst and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed. (3) The Appellate Tribunal may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period. (4) On receipt of an appeal under sub-section (1), the Appellate Tribunal may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against. (5) The Appellate Tribunal shall send a copy of every order made by it to the Board and to the parties to the appeal. (6) The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it. (7) Where any appeal under sub-section (6) could not be disposed of within the period of six months, the Appellate Tribunal shall record its reasons in writing for not disposing of the appeal within that period. (8) Witho....
X X X X Extracts X X X X
X X X X Extracts X X X X
....s of the voluntary undertaking, except in cases covered by sub-section (5). (5) Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33. CHAPTER VIII PENALTIES AND ADJUDICATION 33. Penalties. (1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule. (2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:- (a) the nature, gravity and duration of the breach; (b) the type and nature of the personal data affected by the breach; (c) repetitive nature of the breach; (d) whether the person, as a result of the breach, has realised a gain or avoided any loss; (e) whether the person took....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... of this section, the expressions "computer resource", "information" and "intermediary" shall have the meanings respectively assigned to them in the Information Technology Act, 2000 (21 of 2000). 38. Consistency with other laws. (1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force. (2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict. 39. Bar of jurisdiction. No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act. 40. Power to make rules. (1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act. (2) In particular and without....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... individual by the Data Principal under sub-section (1) of section 14; (q) the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17; (r) the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19; (s) the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20; (t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23; (u) the terms and conditions of appointment and service of officers and employees of the Board under section 24; (v) the techno-legal measures to be adopted by the Board under sub-section (1) of section 28; (w) the other matters under clause (d) of sub-section (7) of section 28; (x) the form, manner and fee for filing an appeal under sub-section (2) of section 29; (y) the procedure for dealing an appeal under sub-section (8) of section 29; (z) any other matter which is to be or may be prescribed or in respect of which provision is to b....