Salient Features Of India’s Digital Personal Data Protection Bill, 2023

by | Aug 23, 2023

Since the Supreme Court recognized privacy as a fundamental right in 2017, the Indian legislature has been committed to establishing a robust data protection framework. This need became even more pronounced after the controversy surrounding WhatsApp’s revised policy raised concerns about sharing users’ personal information with third parties. The Digital Personal Data Protection Bill (DPDP) was introduced to address these issues on August 3, 2023. This bill, which focuses on safeguarding personal data, was presented by the Minister of Railways, Communications, and Electronics and Information Technology before the Lok Sabha. When both Houses approve the DPDP Bill in its current form, it will be elevated to the status of law, becoming the “Digital Personal Data Protection Act, 2023,” after being published in the Official Gazette.

India’s Data Protection Bill

The DPDP Bill marks the Indian government’s second endeavor to establish comprehensive data protection law and privacy legislation. It builds upon India’s data protection regime, particularly Section 43A of the Electronics and Information Technology Act 2000. It is supplemented by the 2011 Electronics and Information Technology Rules.

The proposed Bill in India aims to establish a robust framework for safeguarding personal data, addressing issues like granting rights to the affected data principal, regulating data fiduciaries that process personal data, and implementing measures to prevent personal data breaches while addressing concerns related to targeted advertising and behavioral monitoring.

It also has innovative key features such as storage limitation, delineates the responsibilities of data processors in handling financial assets, and ensures that both the rights of individuals are upheld by mandating that data processing is conducted by seeking consent or under a legally valid contract.

A best digital marketing agency excels in creating effective online strategies to help businesses reach their target audience and achieve their marketing goals by abiding by the digital personal data protection policies laid down by the Indian government.

Key Functions, Stakeholders, And Definitions

The DPDP Bill outlines key stakeholders who will play essential roles in ensuring the protection of personal data publicly:

  • Data Protection Board: This central governing body, to be established by the Central Government, will oversee the implementation of the Act.
  • Data Fiduciary: Any individual or entity, alone or in collaboration with others, that determines the statistical purposes and means of processing personal data.
  • Data Principal: An individual to whom the personal data relates, which includes minors and individuals with disabilities.
  • Data Processor: An entity responsible for processing personal data on behalf of data controllers, ensuring compliance with data protection laws, and maintaining the security and confidentiality of the information.
  • Data Protection Officer (DPO): Data fiduciaries must designate a DPO to enforce legal rights. Furthermore, an autonomous independent Data Auditor could be enlisted to appraise and review data procedures, guaranteeing alignment with statutory provisions. An individual nominated by a Significant Data Fiduciary to oversee and ensure compliance with data protection regulations.
  • Significant Data Fiduciary: Certain Data Fiduciaries have characteristics of Central Government based notifications, such as the volume of data minimization processed and the potential impact on security and public order.
Digital Personal Data Protection Stake Holders

Scope And Application

The DPDP Bill’s scope encompasses innovative features like digitally processing India’s data, collected online or digitized from offline sources. It also extends to the permit processing of digital personal data outside India if related to offering goods, services, or profiling of Data Principals within the country. However, personal data processed for personal or domestic purposes and data made publicly available by the Data Principal or under legal obligations fall outside the bill’s purview.

Data fiduciaries can process data for lawful purposes by seeking the consent of managers of the Data Principal or for ‘certain legitimate uses.’ Before obtaining consent, a Data Fiduciary must provide detailed notices specifying the process data, the purpose, and the Data Principals’ rights.

Conditions For Data Processing By Data Fiduciaries

A Data Fiduciary must ensure ethical and lawful management of personal information. These conditions encompass securing explicit consent from data subjects, articulating the purpose behind data collection, upholding data accuracy, enacting suitable security measures, and adhering to pertinent data protection legislation. Additionally, Data Fiduciaries, notified as Significant Data Fiduciaries, may be obliged to furnish individuals access to their data and establish mechanisms for rectification and erasure. These conditions protect individuals’ privacy while facilitating transparent and legitimate information processing practices.

A Data Fiduciary enforces sensible security measures ensures precise data handling, and implements protocols for notifying breaches. Their responsibilities also extend to erasing personal data once its purpose has been fulfilled.

Rights Of Data Principals

The salient features of the bill recognize the rights of the affected data principals and the fiduciary’s obligations. Affected data principal can access their data, correct inaccuracies, erase personal data and restrict or object to processing for specified purposes. Data fiduciaries are responsible for fulfilling these rights while ensuring the security and data accuracy of the data.

Data Of Children And Persons With Disabilities

Data of children and persons with disabilities hold special significance in data protection. Given their vulnerability, specific safeguards and considerations are often applied to their personal information. Organizations must prioritize their privacy and well-being by obtaining parental or legal guardian consent for processing children’s data, ensuring that the data collected is age-appropriate and serves the child’s best interests. Similarly, data fiduciaries must adopt measures to accommodate the unique needs and rights of persons with disabilities, ensuring equal access, clear communication, and tailored support mechanisms.

Data Protection Board’s Role

The Data Protection Board is pivotal in supervising and upholding data protection regulations within a specific jurisdiction. Its responsibilities encompass interpreting and implementing data protection laws, issuing guidelines and recommendations for organizations to adhere to, and resolving telecom dispute settlements on data privacy matters. Furthermore, the board wields the power to impose financial penalties on entities found contravening data protection regulations, thereby ensuring the responsible management of individuals’ personal information by legal prerequisites.

This board possesses the authority to address and prevent personal data breaches and instances of non-compliance. It holds the capacity to levy substantial penalties for violations. Overseeing the board’s functioning, the Central Government can issue directives as deemed necessary.

It needs to impose financial penalties on non-compliance, including mitigating data breaches of security safeguards and failure to notify breaches. The Central Government can grant exemptions for certain purposes, government entities, and specified purposes.

Cross-Border Personal Data Transfer

Cross-border personal data transfer pertains to relocating individuals’ personal information from one nation or legal jurisdiction to another. This intricate procedure entails managing diverse legal, judicial, or regulatory functions and security factors, all aimed at preserving the data’s security and adherence to pertinent data protection regulations as it traverses international boundaries.

The Central Government can impose storage limitations on cross-border personal data transfers via notifications. This provision ensures that existing laws offering heightened storing data protection will persistently apply and govern these transfers.


The Digital Personal Data Protection Bill 2023 establishes a comprehensive framework for safeguarding personal data in India’s digital landscape. By defining key stakeholders, outlining data manipulation conditions, specifying obligations, and providing for penalties and exemptions, the bill addresses the challenges posed by data privacy and protection in the modern era. If passed into law, it will significantly enhance individuals’ control over their data while holding organizations accountable for responsible data-handling practices.

Rasmita Patro

Rasmita Patro

About The Author…

Meet Rasmita Patro, a content writer, a former teacher, and a former HR with a passion for storytelling, creating compelling content that engages and informs readers. She has a Master’s in Economics and an MBA degree in Human Resources. Her expertise spans a variety of industries, including finance, healthcare, technology, and others. She has a particular inclination toward crafting blog posts, articles, and social media content that resonates with the target audience. She loves reading different genres of books, love to experiment with cooking, and listening to soothing music.

We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.

Cookies settings
Privacy & Cookie policy
Privacy & Cookies policy
Cookie name Active

Privacy Policy

What information do we collect?

We collect information from you when you register on our site or place an order. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address or mailing address.

What do we use your information for?

Any of the information we collect from you may be used in one of the following ways: To personalize your experience (your information helps us to better respond to your individual needs) To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you) To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs) To process transactions Your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested. To administer a contest, promotion, survey or other site feature To send periodic emails The email address you provide for order processing, will only be used to send you information and updates pertaining to your order.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to?keep the information confidential. After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be kept on file for more than 60 days.

Do we use cookies?

Yes (Cookies are small files that a site or its service provider transfers to your computers hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, keep track of advertisements and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business. If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders by contacting customer service. Google Analytics We use Google Analytics on our sites for anonymous reporting of site usage and for advertising on the site. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (

Do we disclose any information to outside parties?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.


The minimum information we need to register you is your name, email address and a password. We will ask you more questions for different services, including sales promotions. Unless we say otherwise, you have to answer all the registration questions. We may also ask some other, voluntary questions during registration for certain services (for example, professional networks) so we can gain a clearer understanding of who you are. This also allows us to personalise services for you. To assist us in our marketing, in addition to the data that you provide to us if you register, we may also obtain data from trusted third parties to help us understand what you might be interested in. This ‘profiling’ information is produced from a variety of sources, including publicly available data (such as the electoral roll) or from sources such as surveys and polls where you have given your permission for your data to be shared. You can choose not to have such data shared with the Guardian from these sources by logging into your account and changing the settings in the privacy section. After you have registered, and with your permission, we may send you emails we think may interest you. Newsletters may be personalised based on what you have been reading on At any time you can decide not to receive these emails and will be able to ‘unsubscribe’. Logging in using social networking credentials If you log-in to our sites using a Facebook log-in, you are granting permission to Facebook to share your user details with us. This will include your name, email address, date of birth and location which will then be used to form a Guardian identity. You can also use your picture from Facebook as part of your profile. This will also allow us and Facebook to share your, networks, user ID and any other information you choose to share according to your Facebook account settings. If you remove the Guardian app from your Facebook settings, we will no longer have access to this information. If you log-in to our sites using a Google log-in, you grant permission to Google to share your user details with us. This will include your name, email address, date of birth, sex and location which we will then use to form a Guardian identity. You may use your picture from Google as part of your profile. This also allows us to share your networks, user ID and any other information you choose to share according to your Google account settings. If you remove the Guardian from your Google settings, we will no longer have access to this information. If you log-in to our sites using a twitter log-in, we receive your avatar (the small picture that appears next to your tweets) and twitter username.

Children’s Online Privacy Protection Act Compliance

We are in compliance with the requirements of COPPA (Childrens Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our website, products and services are all directed to people who are at least 13 years old or older.

Updating your personal information

We offer a ‘My details’ page (also known as Dashboard), where you can update your personal information at any time, and change your marketing preferences. You can get to this page from most pages on the site – simply click on the ‘My details’ link at the top of the screen when you are signed in.

Online Privacy Policy Only

This online privacy policy applies only to information collected through our website and not to information collected offline.

Your Consent

By using our site, you consent to our privacy policy.

Changes to our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.
Save settings
Cookies settings