Implementation Push for DPDP Act, 2023
Polity · Friday, 28 August 2026
The Centre has directed ministries and states to prepare time-bound plans for the implementation of the Digital Personal Data Protection Act. The act establishes a privacy-by-design framework for all government and private data fiduciaries.
Quick highlights
- SARAL approach: Simple, Accessible, Rational, and Actionable.
- Establishes the Data Protection Board of India (DPBI) as the adjudicator.
- Mandates consent-centric processing with specific exceptions for legitimate uses.
- Strict penalties: Up to ₹250 crore for failing to prevent data breaches.
- Prohibits targeted advertising and behavioral tracking of children.
Context
In its first major compliance push, the Centre has directed all Data Fiduciaries to audit data and strengthen cybersecurity.
Key Rights
Individuals (Data Principals) gain the right to access summaries, seek erasure, and nominate representatives. It balances rights with civic duties (e.g., providing false info is penalized).
Significance
It gives statutory effect to the 2017 Puttaswamy judgment and allows cross-border data transfers unless specifically restricted, supporting India's digital economy.
Exam Angle
GS Paper II: Fundamental Rights, Judiciary (Puttaswamy), and e-governance. Prelims: DPBI, TDSAT role, and penalty amounts.
Remember this
- Act: Digital Personal Data Protection Act, 2023.
- Framework: SARAL approach.
- Adjudicator: Data Protection Board of India.
- Appellate Body: TDSAT.
- Max Penalty: ₹250 crore.
- Puttaswamy Judgment (2017): Right to Privacy is a Fundamental Right.