Lok Sabha Question No. 729 (UNSTARRED), answered on 2024-02-07
Subject: DPDPA
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Dhanush M Kumar

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION No. 729

TO BE ANSWERED ON 07.02.2024

## DPDPA

## 729. SHRI DHANUSH M. KUMAR:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)  whether  the  Government has recently  enacted the Digital Personal  Data Protection Act (DPDPA) 2023;
- (b) if so, the details thereof along with the key objectives and applicability of the Act;
- (c) the details on the impact of the Act on the processing of personal data in India including both online and digitized offline data;
- (d) whether the Act is expected to augment India's march towards the adoption of Artificial Intelligence (AI) and other future technologies while protecting Personal Data and if so, the details thereof;
- (e) the measures taken by the Government to ensure companies comply with the rights of the individuals and provide effective redressal  mechanisms linked with significant penalties
- (f)  the  steps  taken  by  the  Government  to  raise  awareness  among citizens about their rights under this Act; and
- (g) the other steps taken / being taken by the Government to ensure compliance with the Act by entities processing personal data both within and outside the country?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a):   Yes, sir.

(b) and  (c):  The policies of the Government are aimed at ensuring that the Internet in India is Open, Safe & Trusted and Accountable to all our Digital Nagriks.

The Digital Personal Data Protection Act, 2023 (DPDP Act) was passed by the Parliament on 8 th August, 2023 and got the assent on the Hon'ble President on 11 th August, 2023.  The Act pertains only the personal data. The Act aims to establish a comprehensive legal framework governing  digital  personal  data  protection,  by  framing  out  the  rights  and  duties  of  Data Principals  and  the  obligations  of  Data  Fiduciaries,  empowering  Data  Principals  and  fixing accountability  of  Data  Fiduciaries.  The  Act  provides  for  the  processing  of  digital  personal data in a manner that recognizes both the rights of the individuals to protect their personal data and for the Data Fiduciaries the need to process such personal data for lawful purposes. The Act puts the obligation on Data Fiduciary to protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The Act may bring in behavioural changes in the data processing activities of the data fiduciaries and prevent the exploitation and misuse of the personal data of the data principals.

The objective of the DPDP Act is to protect digital personal data by providing the obligations on the Data Fiduciaries for processing i.e. collection, storage or any other operation of digital personal data, providing the rights and duties of Data Principals and imposing the financial penalties for breach of rights, duties and obligations.

- i.    within  India  where the personal data is collected in digital form, and also where it is collected in non-digital form and is digitized subsequently;
- ii. outside the territory of India, if such data is processed for offering of goods or services to Data Principals within India.

The Act is not applicable to the processing of digital personal data

- i. for any personal or domestic purpose;
- ii. that is made publicly available by the Data Principal; and
- iii. which is made publicly available pursuant to a legal obligation on any entity to disclose it publicly.

The DPDP Act impacts the digital personal data processing by laying down the principles that are to be followed by Data Fiduciaries to protect digital personal data. The Act may bring in behavioral changes in the data processing activities of the data fiduciaries and prevent the exploitation and misuse of the personal data of the data principals.

- (d):    No  Sir.  The  DPDP  Act  is  a  legislation  meant  to  protect  the  fundamental  right  of  the citizen to privacy online.
- (e):    The  DPDP  Act  provides  for  a  Data  Protection  Board,  which  will  be  responsible  for adjudicating and determining the consequences of noncompliance of any data fiduciary and imposing  punitive  financial  penalty  on  those  Data  Fiduciaries  that  violates  the  Act  and/or cause breach of the personal data that they have collected form Data Principal(s).
- (f):  Government has conducted and continues to conduct many public awareness campaigns to make citizen aware of their rights  under IT Act, IT Rules and DPDP act.
- (g):  In the DPDP Act, there is a provision of a Data Protection Board which will look into compliance  with  the  Act  by  entities  processing  personal  data.  The  Government  intends  to provide  sufficient  time  of  between  six  to  twelve  months  depending  on  the  type  of intermediary to transition from the current regime to  the new regime as per the new DPDP Act. Compliance of the DPDP Act is mandatory for all Data Fiduciary that operates on Indian Internet.

******