India's Digital Personal Data Protection Act 2023 Explained

Understanding privacy laws can be convoluted and often feel overwhelming. In this article, we will delve into what India's new data privacy law from 2023, Digital Personal Data Protection Act (DPDPA), requires of you and your business. We will do it in easy to understand, digestible tidbits that equip you with the knowledge of how you can protect your business.

DPDPA in a nutshell

To understand DPDPA, you need to know a few key terms as they outline what counts under this law, who is responsible, and what you can do to make sure you abide by the new rules.

Personal data

• Any data about an individual who can be identified, whether directly or indirectly.
• Includes obvious identifiers (name, phone number, email) and digital identifiers (IP addresses, location, cookies).
• Covers only digital personal data, not paper records unless digitised.

Key Roles Under the DPDPA

• Data Principal: The individual whose data is collected (the “owner” of the data).
• Data Fiduciary: The entity that decides why and how personal data is processed (like a controller).
• Significant Data Fiduciary: Large or high-risk organisations with extra obligations (like impact assessments and audits).

What should you and your business do now?

• Map the personal data you collect and why.
• Update consent forms and privacy notices.
• Train employees on handling personal data (check out our ready-made platform!)
• Prepare for audits and data breach response.

🥭 Mango Moment:
Our training is built for India, so you and your team get clear, practical guidance on what the DPDPA means in real life. From collecting data to keeping it safe, we make sure everyone knows the rules without drowning in legal talk. Sign up to receive automated training schedules of 3-5 minute videos with practical short quizzes to make sure you stay on top of what you need to do.

What happens if you do not follow these principles? DPDPA's penalties

What's the Data Protection Board of India?

The Data Protection Board of India (DPBI) is a newly created regulator, its role is to make sure companies in India treat personal data responsibly and uphold people’s privacy rights. It has 3 main responsibilites:

1. Enforcing the law
2. Investigating complaints from individuals
3. Handling data breach reports.

The Data Protection Board of India imposes strong enforcement for any personal data, if you do not comply you can face significant fines up to ₹250 crore (~USD 30 million) for serious breaches

Not only could you be subject to fines, you will also tarnish your company's reputation, and individuals may be able to pursue legal action against your business.