The Digital Personal Data Protection (DPDP) Act: Compliance Guidelines

With the enforcement of the Digital Personal Data Protection (DPDP) Act, India joined the global cohort of nations with dedicated data privacy legislation. The Act fundamentally changes how businesses collect, store, and process digital personal data of Indian citizens (data principals).

1. Data Fiduciary Responsibilities

Organizations collecting data are categorized as 'Data Fiduciaries' and bear the primary responsibility for compliance. They must obtain explicit, specific, unconditional, and unambiguous consent before processing personal data. Consent notices must be provided in English or any of the 22 languages specified in the Eighth Schedule of the Indian Constitution, at the option of the data principal.

2. Rights of Data Principals

Individuals now possess statutory rights to access information about their processed data, demand correction or erasure, seek grievance redressal, and nominate individuals to act on their behalf in case of death or incapacity.

3. Heavy Penalties for Non-Compliance

The DPDP Act does not provide for criminal prosecution, but instead institutes significant financial penalties. Neglecting to put in place reasonable security safeguards to prevent data breaches can result in penalties up to INR 250 Crores, determined by the Data Protection Board of India on a case-by-case basis.

Steps for Immediate Implementation

• Data Mapping: Identify where digital personal data enters your enterprise, who has access, and how it is stored.
• Privacy Notice Overhaul: Re-write consumer consent terms to be clear and language-compliant.
• Appoint a Data Protection Officer (DPO): Ensure a dedicated point of contact is established to handle data grievances and interface with regulators.