India's DPDP Act in plain language: a primer for businesses
By the AOZO Team · · 6 min read
The short answer
Under the DPDP Act, a business that decides why and how personal data is used is a Data Fiduciary. It must have a valid ground, give notice, keep data safe, and honour people's rights.
What the law is
The Digital Personal Data Protection Act, 2023 is India's law on handling digital personal data. It applies to personal data processed in India, and to some processing outside India that offers goods or services to people in India.
This is a plain-language overview, not legal advice. Talk to a lawyer about your own situation, and check the latest rules, since the law is being phased in.
Words you will hear
- Data Principal: the person the data is about.
- Data Fiduciary: the business that decides why and how personal data is used.
- Data Processor: a business that handles data on behalf of a Data Fiduciary, such as a software provider.
- Consent Manager: an entity that helps people give, manage and withdraw consent.
- Data Protection Board of India: the body that handles complaints and breaches.
What you owe people
- A valid ground: either free, specific, informed and clear consent, or a listed legitimate use such as legal compliance or employment purposes.
- A notice that says what data you collect, why, how to exercise rights and how to complain.
- Reasonable security safeguards, and telling the Board and affected people about a breach.
- Erasing data when its purpose is done or consent is withdrawn, unless the law requires you to keep it.
- A way to handle grievances, with a contact person who can answer questions.
- Extra care for children's data: verifiable parental consent, and no tracking or targeted advertising aimed at children.
Rights people have
People can ask for a summary of their data, ask to correct or erase it, withdraw consent, get their grievance heard, and nominate someone to act for them.
Where to start
- List what personal data you hold and where it lives.
- Write down why you hold each kind, and the ground you rely on.
- Publish a clear privacy notice and a simple way to withdraw consent.
- Check your vendors. Make sure they sign a data processing agreement.
- Name someone to handle requests and grievances, and decide how you will respond to a breach.
This article is for general information and is not legal, tax or financial advice. Rules change, so check current requirements with a qualified professional.
