Lok Sabha Question No. 2797 (UNSTARRED), answered on 2023-12-20
Subject: Data Protection Authority
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Arvind Ganpat Sawant

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION No. 2797

TO BE ANSWERED ON 20.12.2023

## DATA PROTECTION AUTHORITY

## 2797.    SHRI ARVIND GANPAT SAWANT:

Will the Minister of Electronics and Information Technology be pleased to state:

- (a) whether the Data Protection Authority (DPA) has been formed as per the recently passed Personal Data Protection Act by the Parliament, if so, the details thereof;
- (b) if not, the time by which it is to be formed;
- (c) the duties and responsibilities of this Authority(DPA);
- (d) the details of organisations which have to be exempted from the purview of this Act; and
- (e) the reasons for exempting such organisations from the purview of this Act?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a) to (c):  The policies of the Government are aimed at ensuring that the Internet in India is Open, Safe & Trusted and Accountable to all  users.

Hon'ble PM launched the Digital India programme with the vision of transforming India into a digitally empowered society and a knowledge-based economy, by ensuring digital access, digital  inclusion,  digital  empowerment  and  bridging  the  digital  divide.  The  programme  is centered on three objectives, namely digital infrastructure as a core utility to every citizen, governance and services on demand, and digital empowerment of citizens. Digital India has resulted in the digitalization of the Indian economy and that has resulted in good by enhanced ease of living for the users, Simultaneously, these users are also increasingly at the risk of harm from misuse of their personal data.

The Supreme Court, in its judgement in the Puttaswamy case in 2017, has declared the right to  privacy  is  protected  as  intrinsic  part  of  the  fundamental  rights  guaranteed  by  the Constitution.  As  the  data  and  particularly  the  personal  data  is  at  the  core  of  the  digital economy and eco-system of digital products, services and intermediation, it is most optimum that  platforms  and  intermediaries  be  subjected  to  a  legal  framework.  In  this  framework  of global  standard  cyber  laws  and  along  with  the  vision  of  a  future  full  of  technological opportunities  the  Digital  Personal  Data  Protection  Act,  2023  (DPDP  Act)  was  enacted  on 11th August 2023. The DPDP Act provides for the processing of digital personal data in a manner  that  recognizes  the  need  to  process  personal  data  for  lawful  purposes  by  the  data fiduciaries. In addition, the DPDP Act also provides for the rights of the individuals to protect their personal data.

As per Section 18(1) of the DPDP Act, the Central Government may by notification appoint a Board to be called the Data Protection Board of India, with the following functions:

- (i) inquiring into the personal data breaches;
- (ii) taking into account the complaints made by the data Users against the data fiduciaries for not adhering to the provisions of The DPDP Act;
- (iii)adjudicate on the above matters and decide on the monetary penalties to be imposed
- (iv) direct remedial and mitigating measures to the data fiduciaries to handle breaches
- (v) to advise the government to block the website or the App if they are found repeatedly breaching the provisions of The Act in the interest of general public.

(d)  to  (e):    Section  17of  the  DPDP  Act,  2023  provides  for  selective  exemptions  from  the provisions of the DPDP Act for processing of personal data for certain specific functions like enforcing  legal  rights,  judicial  or  quasi-judicial  or  regulatory  or  supervisory  function, research, archiving or statistical purposes and entities like startups. Presently, no organization has been exempted from the purview of the Act.

*******