Assessing India’s Digital Personal Data Protection Act, 2023 - A Comparative Study With The GDPR
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
ASSESSING INDIA’S DIGITAL PERSONAL DATA
PROTECTION ACT, 2023: A COMPARATIVE STUDY WITH
THE GDPR
Vaibhav Dharod, DY Patil University, School of Law Kevin Tauro, DY Patil University, School of Law
ABSTRACT
With the increasing digitization of personal data, the need for comprehensive data protection laws has become paramount. The General Data Protection Regulation (GDPR) of the European Union is considered the global benchmark for data privacy and security. In response to similar concerns, India has introduced the Digital Personal Data Protection (DPDP) Act, 2023, aiming to regulate personal data collection, processing, and protection. This paper explores the necessity of data protection, key threats to personal data, and the principles of an effective data protection framework. It then provides an overview of India’s DPDP Act, 2023, tracing its evolution, key provisions, and intended impact. A core focus of this study is the comparative analysis between India’s DPDP Act and GDPR, highlighting areas of alignment, significant differences, and potential gaps.
The research critically examines whether India’s DPDP Act meets the standards set by GDPR and whether it offers adequate safeguards against cyber threats, data breaches, and misuse of personal information. By identifying key challenges and regulatory shortcomings, this paper aims to contribute to the ongoing discourse on India’s evolving data protection regime and its effectiveness in the global digital landscape.
Objective Here are the objectives:
1. To understand the importance of data protection in the digital age and examine key
threats to personal data.
2. To analyze the Digital Personal Data Protection (DPDP) Act, 2023, its key features,
and its intended impact on data privacy in India.
3. To conduct a comparative analysis between the DPDP Act, 2023, and the General
Data Protection Regulation (GDPR), highlighting similarities and differences.
1. Introduction
In an increasingly digital world, personal data has become a critical asset, leading to rising concerns over privacy, security, and regulatory oversight. Governments worldwide are enacting data protection laws to address cyber threats, data breaches, and unauthorized access to sensitive information. The General Data Protection Regulation (GDPR), introduced by the European Union in 2018, is widely regarded as the most comprehensive data protection law, influencing regulatory frameworks globally. Recognizing the need for a robust legal mechanism to govern personal data, India enacted the Digital Personal Data Protection (DPDP) Act, 2023. This law aims to regulate the collection, processing, and storage of digital personal data while balancing privacy rights, national security, and business interests.
However, its implementation remains pending, raising concerns about its effectiveness in practice. This research paper examines the DPDP Act, 2023, analyzing its key features and evaluating its adequacy in protecting personal data. It further compares the Act with the GDPR, assessing its similarities, differences, and potential gaps. By drawing a comparative analysis, this study seeks to determine whether India’s DPDP Act aligns with international data protection standards set by the GDPR and if it provides a sufficient legal framework for safeguarding personal data in India.
2. Understanding Data Protection and Its Need
2.1 What is Data Protection?
Data protection refers to the legal, technical, and organizational measures designed to safeguard personal data from unauthorized access, misuse, alteration, and loss. It ensures that individuals have control over how their personal information is collected, stored, processed, and shared. Personal data includes any information that identifies an individual, such as name, contact details, financial records, health data, and online activity. Data protection laws, such as the General Data Protection Regulation (GDPR) in the EU and the Digital Personal Data Protection Act, 2023 (DPDP Act) in India, establish rules for organizations and governments on how to handle personal data responsibly.
2.2 Why is Data Protection Necessary in the Digital World?
With the rapid advancement of technology and digital transformation, vast amounts of personal data are collected daily by governments, businesses, and digital platforms. The need for strong data protection arises from:
1. Privacy Concerns: Without data protection laws, personal information can be
misused, leading to privacy violations and loss of individual autonomy.
2. Cybersecurity Risks: Cybercriminals exploit weak data security to steal, manipulate,
or sell personal data.
3. Rise of Data-Driven Businesses: Companies rely on data for marketing, analytics, and
AI-driven decision-making, making it essential to regulate how data is processed.
4. Legal Compliance: Many countries now require businesses to comply with strict data
protection laws, failure of which can lead to legal consequences.
5. Trust in Digital Services: Secure data handling practices boost public confidence in
online services, encouraging safe digital transactions and engagement.
2.3 Key Threats to Personal Data
Several cyber threats compromise personal data security, including:
1. Cybercrime and Hacking: Hackers target organizations and individuals to steal
sensitive data for financial gain, espionage, or fraud.
2. Data Breaches: Unauthorized access to personal data stored by businesses and
institutions can lead to financial losses and reputational damage. Example: The Cambridge Analytica scandal exposed how personal data was exploited for political purposes.
3. Identity Theft: Criminals use stolen personal data to impersonate individuals, commit
fraud, or access bank accounts and government services.
4. Phishing and Social Engineering Attacks: Deceptive tactics trick users into revealing
personal information, often leading to financial fraud.
5. Unauthorized Data Sharing: Companies may share or sell personal data without user
consent, violating privacy rights.
2.4 Principles of a Strong Data Protection Framework
A robust data protection framework must incorporate key principles to ensure personal data is
handled securely and ethically. GDPR sets the gold standard with the following seven principles:
1. Lawfulness, Fairness, and Transparency: Organizations must process data legally,
fairly, and transparently.
2. Purpose Limitation: Data should only be collected for specific, legitimate purposes.
3. Data Minimization: Only necessary data should be collected and processed.
4. Accuracy: Personal data must be kept accurate and up to date.
5. Storage Limitation: Data should not be retained longer than necessary.
6. Integrity and Confidentiality: Strong security measures should protect data from
breaches and cyber threats.
7. Accountability: Organizations must take responsibility for complying with data
protection laws. India’s DPDP Act, 2023, also introduces similar principles, but its effectiveness depends on enforcement mechanisms and implementation. This paper will assess whether India’s framework meets these international standards and where it may fall short.
3. Overview of India's Digital Personal Data Protection Act, 2023
3.1 History and Development of Data Protection Laws in India
India's journey toward a comprehensive data protection law has been long and evolving, shaped by increasing digitalization and concerns over personal data security. While India had existing frameworks like the Information Technology (IT) Act, 2000, and its IT Rules, 2011, they were insufficient in addressing modern data privacy challenges. The need for a robust data protection law gained momentum after the landmark Supreme Court judgment in K. S. Puttaswamy v. Union of India (2017), which recognized privacy as a fundamental right under Article 21 of the Indian Constitution. Following this, the government appointed the Justice B. N. Srikrishna Committee to draft a data protection framework, leading to the introduction of the Personal Data Protection Bill (PDPB) in 2019.
However, after years of deliberation and several amendments, the bill was withdrawn and replaced by the Digital Personal Data Protection Act, 2023 (DPDP Act). The DPDP Act, 2023, marks India's first comprehensive legislation solely focused on protecting digital personal data. It seeks to balance individual rights, business interests, and national security, aligning India with global data protection trends while addressing local concerns.
3.2 Key Features of the DPDP Act, 2023
The DPDP Act establishes a structured approach to data governance and imposes obligations on entities that collect and process personal data. Below are its key provisions:
1. Rights of Individuals (Data Principals)
The Act empowers individuals, referred to as Data Principals, by granting them specific rights
over their personal data. These include: ● Right to Access Information – Individuals can request details about the personal data collected and how it is being processed. ● Right to Correction and Erasure – Data Principals can correct, update, or request the deletion of inaccurate or unnecessary personal data. ● Right to Data Portability – Although not explicitly mentioned like in the GDPR, the law allows Data Principals to access their own data, facilitating portability. ● Right to Grievance Redressal – Individuals can file complaints with Data Fiduciaries or escalate them to the Data Protection Board of India if their rights are violated.
2. Obligations of Businesses (Data Fiduciaries)
Entities that collect, store, and process personal data are known as Data Fiduciaries under the Act. They are required to: ● Obtain user consent before collecting data unless covered under specific exemptions. ● Ensure data security by implementing necessary safeguards. ● Limit data collection and processing to what is necessary for the specified purpose. ● Appoint a Data Protection Officer (DPO) (for significant Data Fiduciaries). ● Comply with the Data Protection Board's regulations in case of a data breach or violation.
3. Consent and Data Processing Rules
The DPDP Act is primarily consent-based, meaning businesses must seek explicit, informed, and affirmative consent before processing personal data. Key aspects include: ● Notice & Consent: Data Fiduciaries must provide clear notices on data collection purposes.
● Withdrawal of Consent: Individuals can withdraw consent at any time, requiring businesses to cease data processing. ● Legitimate Uses Without Consent: The Act allows data processing without consent for specified cases, such as legal compliance, government functions, or emergencies. Unlike GDPR, which has multiple legal bases for processing data (e.g., legitimate interest), the DPDP Act relies more on user consent and limited "deemed consent" situations.
4. Data Localization and Cross-Border Data Transfers
A crucial aspect of India's data protection regime is the handling of cross-border data flows.
Earlier drafts proposed strict data localization, but the final DPDP Act is more flexible: ● Permits cross-border data transfers to "trusted" countries, which will be notified by the Indian government. ● No strict data localization requirement, but sensitive data handling measures may still be prescribed through future rules. This approach attempts to strike a balance between global business needs and national security concerns.
5. Penalties for Non-Compliance
The DPDP Act establishes significant penalties for violations to ensure accountability: ● Failure to prevent data breaches: Up to ₹250 crore fine. ● Non-compliance with user rights requests: Up to ₹200 crore fine. ● Breach of children’s data processing rules: Up to ₹200 crore fine. ● Failure to report data breaches: Penalties ranging from ₹50 crore to ₹150 crore. Compared to GDPR (which imposes fines up to €20 million or 4% of global turnover), the DPDP Act also introduces heavy penalties, though enforcement mechanisms remain a concern.
Conclusion The DPDP Act, 2023, is a crucial step in India's data protection evolution, aligning with global standards like GDPR while adapting to India’s digital economy. However, with implementation still pending, the real challenge lies in enforcement, compliance readiness, and its effectiveness in protecting personal data. This paper will critically evaluate whether India's data protection law is strong enough to meet global standards and protect citizens in the digital era.
5. Comparing India’s DPDP Act with GDPR (Global Data Protection Law)
India’s Digital Personal Data Protection (DPDP) Act, 2023, is an attempt to create a comprehensive framework for protecting personal data, similar to the European Union’s General Data Protection Regulation (GDPR) and other global laws. However, differences exist in scope, user rights, enforcement mechanisms, and cross-border data transfers. This section explores how the DPDP Act compares with the GDPR and other global data protection laws, such as the California Consumer Privacy Act (CCPA), Singapore’s Personal Data Protection Act (PDPA), and China’s Personal Information Protection Law (PIPL).
5.1 GDPR vs. DPDP Act
The General Data Protection Regulation (GDPR) is often considered the gold standard in data protection laws worldwide. It applies not only to organizations within the EU but also to any entity processing the personal data of EU residents. Below is a comparison of key aspects of GDPR and the DPDP Act:
1. Scope and Applicability
Type of Data Covered Covers personal data and Covers only digital personal sensitive personal data (like data (offline data is health, biometrics, etc.). excluded). Data Data controllers must justify the Heavily consent-based with basis of data processing (consent, limited cases of deemed Fiduciary/Controller legitimate interest, contract, legal consent. Obligations obligation, etc.). Children’s Data Requires parental consent for data Requires parental consent for processing of children under 16. data processing of children under 18. Key Difference: The GDPR applies to offline and online data, while the DPDP Act is limited to digital data. The GDPR has broader territorial reach, covering even foreign companies handling EU residents' data, while the DPDP Act's extraterritorial scope is unclear.
2. Rights of Individuals (Data Subjects vs. Data Principals)
Both laws give individuals certain rights over their personal data, but the scope differs:
Right to Object Users can object to processing No explicit provision. based on legitimate interests. Right to Data Portability Users can transfer their data to No specific provision. another service provider. Right to Restriction of Users can limit how their data is No explicit provision. Processing used. Key Differences: ● The GDPR provides a broader range of rights, including data portability and objection to data processing. ● The DPDP Act does not explicitly recognize the right to object to processing or the right to restrict processing. ● Right to be Forgotten is stronger in GDPR, while DPDP’s version is subject to government rules and enforcement.
3. Data Processing and Consent Requirements
Key Difference: The GDPR allows processing based on multiple legal grounds (legitimate interest, contract, public task, etc.), while the DPDP Act is highly consent-centric, with limited exceptions for deemed consent.
4. Data Security and Enforcement Mechanisms
Feature
GDPR
DPDP Act, 2023 Data Breach Mandatory within 72 hours. Mandatory but without a strict timeframe. Notification Regulatory European Data Protection Board Data Protection Board of India Authority (EDPB) supervises implementation. (DPBI) will enforce compliance. Penalties Fines up to €20 million or 4% of Fines up to ₹250 crore (~€28 global turnover, whichever is higher. million) for non-compliance. Key Difference: ● The GDPR has a structured enforcement mechanism, while the DPDP Act's enforcement system is still evolving. ● GDPR imposes stricter breach notification deadlines (72 hours), whereas the DPDP Act lacks a specific timeline.
5. Cross-Border Data Transfers
Data No strict localization No strict localization but government requirements. control over cross-border transfers. Localization Key Difference: GDPR is flexible on data transfers (allows Standard Contractual Clauses, Binding Corporate Rules), whereas DPDP gives the government power to decide which countries qualify as “trusted” for data transfers.
5. Findings
This research reveals:
1. The Importance of Data Protection in the Digital Age and Key Threats to Personal Data
2. Comparative Analysis of DPDP Act, 2023, and GDPR
6. Conclusion
The DPDP Act, 2023, marks a significant step toward strengthening data protection in India, but its effectiveness will depend on its implementation and enforcement mechanisms. While it aligns with GDPR in many respects, the lack of independent oversight, government exemptions, and absence of certain user rights indicate that it still falls short of achieving a global standard of data privacy. To ensure robust data protection, India must focus on stronger enforcement, minimizing government interference, and enhancing user rights, bringing its legal framework closer to GDPR’s well-established protections.