Digital Personal Data Protection Act
The Digital Personal Data Protection (DPDP) Act, 2023, is India's dedicated law governing the processing of digital personal data, balancing individuals' privacy with lawful data use.
The Digital Personal Data Protection (DPDP) Act, 2023, is India's dedicated law governing the processing of digital personal data, balancing individuals' privacy with lawful data use.
Core principles
The Act is built around consent, purpose limitation and data minimisation. Entities processing data ('data fiduciaries') must handle personal data lawfully and for specified purposes.
Key terms
A 'data principal' is the individual to whom the data relates; a 'data fiduciary' determines the purpose and means of processing. The Act gives individuals rights over their data.
Enforcement
A Data Protection Board of India is to be set up to adjudicate breaches and impose penalties, and the law provides for exemptions in specified circumstances.
Why it matters for UPSC
Following the Supreme Court's recognition of privacy as a fundamental right, the DPDP Act is a key governance topic linking rights, technology and law.
Practise related UPSC PYQs
See how this topic has actually been asked. Solve real UPSC Prelims previous year questions with answers and explanations — free.
Practise PYQs →Frequently asked questions
What does the Digital Personal Data Protection Act regulate?
The processing of digital personal data in India, based on consent and purpose limitation.
Who is a 'data fiduciary' under the Act?
An entity that determines the purpose and means of processing personal data.