India, the world’s largest democracy, has achieved a milestone with the enactment of the Digital Personal Data Protection Act (DPDPA), 2023. This landmark legislation is introduced for protecting the fundamental right of data privacy for Indian citizens, making sure that both physical and digital spaces are safe. 

Imagine a time when there was no online shopping, no apps to order food, and no cab services at your fingertips. Every small task used to require stepping out—the shop for buying, bank for transferring money, and even a travel agency for tickets. Today, it feels almost unthinkable. Over the years, globalization, liberalization, and technological advancement have shifted these activities to virtual platforms. Now, everything from groceries to gadgets arrives at your doorstep with just a click. 

However, there’s always a catch for the convenience of technology with your personal data. Every app and service collect bits of your data under “terms and conditions” or “cookies.” These terminologies are so lengthy and full of jargon that nobody bothers to read through them; most just hit the “Accept.” Button. This data, while essential for services, also poses a significant risk if mishandled. Whether it is shopping online, booking a cab, or streaming a show, every transaction reveals something about you—your habits, preferences, or even sensitive financial information. Misuse of such data not only threatens individual privacy but could have far-reaching implications on national security. 

Before DPDPA: The Struggle to Protect Privacy 

India’s approach to data protection was long defined by fragmented laws that struggled to keep pace with the digital era. The Information Technology Act, 2000, was the country’s first legislative attempt to address cybersecurity concerns. However, it fell short of adequately safeguarding personal data privacy. In response to tackle these challenges, the IT Rules, 2011 were introduced to provide specific protections for sensitive personal data. 

However, these rules offered a more targeted approach but were still limited in scope. Recognizing the growing need for comprehensive regulation, the IT Rules, 2021 further expanded oversight, bringing online platforms under greater scrutiny and reinforcing the need for robust data privacy protections in the digital era. Despite these efforts, the lack of a unified, comprehensive framework left significant gaps, which were eventually addressed by the enactment of the Digital Personal Data Protection Act, 2023 (DPDPA). 

However, these measures failed to keep pace with the changing digital landscape. The landmark case of Justice K.S. Puttaswamy vs. Union of India in 2017 highlighted the need for protecting the privacy of individuals along with holistic data protection. The Supreme Court’s declaration of privacy as a fundamental right under Article 21 of the Constitution paved the way for more stringent legislation. In response, the B.N. Srikrishna Committee drafted the Personal Data Protection Bill, 2018, which started national debates on accountability, individual rights, and data usage. These efforts brought to the fore the need for a unified framework, which eventually led to the Digital Personal Data Protection Act, 2023 (DPDPA). 

After years of consultation, deliberation, and feedback, the government went ahead to pass the Digital Personal Data Protection Act, 2023 (DPDPA).  

DPDPA marks a new thinking in personal data handling/processing within India. A landmark law defining the responsibilities among data handlers and rights for individuals while ensuring transparency around data collection, storage, and use for the betterment of Indians. The DPDPA represents a fair balance between advancing technological development, business growth, and the fundamental right to privacy. 

After DPDPA: A New Era of Accountability 

With the enactment of the DPDPA, individuals are now empowered to take control of their personal data. However, companies must adhere to strict regulations, ensuring data is collected only when necessary and used responsibly. The Act also introduces penalties for data breaches and non-compliance, making accountability the cornerstone of India’s digital transformation. 

Compliance with the provisions of the Act is crucial to avoid penalties (which can extend up to Rs. 250 crore) and also loss of trust.

Journey of Data Protection Law in India 

The journey of India’s data protection law began in 2018 with the first draft of the Personal Data Protection Bill, submitted by the Justice Srikrishna Committee. The bill was presented in Parliament in December 2019 and was referred to the Joint Parliamentary Committee (JPC), which submitted its report in December 2021. A revised Data Protection Bill, 2021 was later withdrawn in August 2022, and a new draft was introduced by the Ministry of Electronics and IT. The Digital Personal Data Protection Bill, 2023, was introduced in the parliament on 3 August 2023, passed by Lok Sabha on 7 August, and by Rajya Sabha on 9 August. Following presidential assent on 11 August 2023, it became the Digital Personal Data Protection Act, 2023.