A Look at India’s Digital Personal Data Protection Act

India boasts 759 million active internet users who flood the sphere with a massive amount of personal data. With this number predicted to grow to 900 million by 2025, the recently-passed Digital Personal Data Protection (DPDP) Act is generally seen as timely, although some commentators argue that more should be done.

What the Act Broadly Entails

The Act is broadly in alignment with the Data Protection laws of Singapore's Personal Data Protection Act (PDPA) and similar regulations in other ASEAN countries. 

Every person who processes personal data for, in essence, business purposes is mandated to give a notice to individuals about the processing, about the individual’s rights and about how to make a complaint. It has to be in English and/or in any of India's other 21 official languages. This aims to ensure that language barriers are not an impediment to users' understanding of data usage practices. 

Five Years in the Making 

Back in August 2017, the Supreme Court of India found that there is an implied right to privacy in the Indian Constitution. So, it was necessary to enact legislation to regulate that right. The first thing that the Indian Government did was to set up a committee to work out what the law should cover and how it should be covered. After much debate and at least two major bills were proposed, the final bill was submitted to the Indian Parliament at the beginning of August 2023. It passed quickly - just a few days were taken - and then the President of India completed the formal part of passing a new law by ‘assenting’ to it. 

Now, we will see a period where a lot of the practicalities are worked out and published - similarly to the way the PDPA was passed in Singapore in December 2012 but did not come into full force until 2 July 2014. We will continue to observe the developments. 

Want to learn more about what the Act entails and what it means for the ASEAN region? Sign up for our Fireside Chat: Highlights of the New India Digital Personal Data Protection Act.