Digital Personal Data Protection Act, 2023 gets the President's assent

What the law covers

The Act applies to the use of personal data in digital form in India, and to data collected on paper and later digitised.

• Data Principal: the person the data belongs to. For a child, the parents or lawful guardian as well.
• Data Fiduciary: the person or body that decides why and how the data is used.

Main points

• Personal data can be used only with the person’s consent, or for certain legitimate uses listed in the Act.
• A request for consent must come with a clear notice of what data is being taken and for what purpose.
• People have the right to know about their data, to have it corrected or erased, and to complain.
• A child’s data needs verifiable consent from a parent.
• The Data Protection Board of India oversees compliance. A breach can lead to a penalty of up to 250 crore rupees.

When it applies

The provisions come into force on the dates the Central Government notifies (Section 1(2)). Different dates can be set for different provisions.