The Act is enacted, not yet fully operative
The Digital Personal Data Protection Act 2023 received presidential assent
in 2023, but a statute of this kind generally needs detailed rules before its
obligations can be fully enforced in practice, covering matters such as the
functioning of the Data Protection Board, the process for Consent Managers,
and specifics of notice and consent. Those rules have been at various stages
of finalisation. We advise clients to treat the Act as the direction of
travel and build compliance towards it, while checking, for any specific
obligation, whether it is actually in force at the relevant time.
Data Principals, Fiduciaries, and consent
The Act uses its own vocabulary. The individual to whom personal data
relates is a Data Principal. The entity that decides how and why that data is
processed is a Data Fiduciary. Processing generally requires the Data
Principal’s consent, given through a notice describing what data is
collected and for what purpose, though the Act also recognises certain
legitimate uses that do not require fresh consent. Data Fiduciaries have
obligations to keep data accurate, protect it against breach, and honour
rights the Act gives Data Principals, including a right to access and, in
defined circumstances, erasure.
Consent Managers
The Act introduces the concept of a Consent Manager, an entity registered to
allow individuals to give, manage, and withdraw consent across multiple Data
Fiduciaries through a single interface. This is a genuinely new feature of
the Indian framework, and the ecosystem for registering and operating as a
Consent Manager is still developing, so most businesses will interact with
this concept as it matures rather than immediately.
What already applies
Independently of the DPDP Act’s timeline, the Information Technology Act
2000 and rules made under it already impose obligations on businesses
handling personal and sensitive personal data, and CERT-In directions require
reporting of certain cyber incidents within prescribed timeframes. We advise
clients to meet these existing obligations now, since they do not wait for
the DPDP Act’s rules to be finalised, and build DPDP-aligned practices
alongside them so the two sets of obligations are addressed together rather
than as separate projects at different times.
