Published on: 11th January 2026
Authored by: Yashwi Fogla
MIT-WPU
Abstract
This article examines the Digital Personal Data Protection Act, 2023 (“DPDP Act”) [1]in the Indian legal context. It traces the Act’s legislative background, analyses its core provisions, evaluates strengths and weaknesses in safeguarding informational privacy, and assesses the DPDP Act’s compatibility with constitutional privacy jurisprudence, particularly in light of K.S. Puttaswamy v. Union of India[2]. The article concludes with recommendations to enhance accountability, procedural safeguards, and enforceability to ensure robust data protection in India.
Introduction
The passage of the Digital Personal Data Protection Act, 2023[3] (hereinafter “DPDP Act”) marks a significant legislative effort by India to regulate the collection, processing, and transfer of digital personal data. The DPDP Act seeks to balance two competing objectives: the protection of the individual’s right to informational privacy and the facilitation of legitimate uses of data for commercial and governance purposes. This tension between private autonomy and public/commercial interests lies at the heart of contemporary data protection debates worldwide.
Legislative and Judicial Backdrop
India’s modern data protection trajectory began with the Justice B.N. Srikrishna Committee report of 2018, which proposed a comprehensive framework for personal data protection and influenced subsequent drafts of legislation. The DPDP Act draws on these recommendations but also reflects significant policy choices and departures. Meanwhile, the Supreme Court’s seminal judgment in K.S. Puttaswamy (Retd.) v. Union of India[4]established the right to privacy as intrinsic to Article 21 of the Constitution, thereby creating a constitutional framework within which statutory regulation must operate. Any data protection law must therefore be assessed for its capacity to secure the substantive and procedural dimensions of privacy recognized by the Court.
Scope and Applicability
The DPDP Act applies to the processing of digital personal data[5] where such data is collected online or collected offline and digitized. The Act’s territorial scope extends to processing outside India if it is undertaken for offering goods or services to individuals in India, mirroring extraterritorial features present in other modern data protection regimes. The Act distinguishes between ordinary data fiduciaries and “significant data fiduciaries” (SDFs) entities that process large volumes of data or have the potential to cause significant impact on data principals. SDFs are subject to enhanced obligations and oversight mechanisms.
Foundational Principles and Grounds for Processing
At the core of the DPDP Act are principles that regulate lawful processing, purpose limitation, data minimization, and fairness. The Act enumerates multiple grounds for processing including consent, performance of public functions or contract, compliance with law, protection of vital interests, and certain legitimate uses where consent may not be required.9 While the inclusion of non-consensual grounds aligns with pragmatic governance needs, it raises concerns regarding scope creep and potential state or private overreach. The Act places emphasis on notice requirements, though the effectiveness of notice-based consent regimes is often questioned in privacy literature, especially when notices are complex.
Rights of Data Principals and Remedies
The DPDP Act provides a range of rights to data principals, including the right to confirmation, access, correction, and erasure in certain circumstances. Notably, the Act contemplates mechanisms for grievance redressal and penalties for breaches. However, the Act’s remedial architecture administrative fines and limited civil liabilities has been criticized as insufficiently deterrent for large-scale economic actors. The Act’s enforcement model, which relies heavily on regulatory adjudication rather than private causes of action analogous to damages claims, may constrain the practical remedies available to aggrieved individuals.
Institutional Framework and Oversight
The Act establishes an authority to oversee implementation and adjudicate complaints, with powers to investigate data breaches and impose penalties. In contrast to earlier proposals that envisaged a stronger, more autonomous data protection authority with layered independence, the DPDP Act places significant discretion in executive rule-making and authority appointments. The independence, resources, and technical capacity of the authority will be decisive factors for the DPDP Act’s success.
Cross-border Data Flows and Localization
Cross-border transfer rules under the DPDP Act are calibrated to permit transfers subject to conditions or contractual safeguards. The Act stops short of sweeping data localization mandates but retains the government’s power to notify certain categories of data for localization for strategic reasons. While this balancing attempt seeks to reconcile economic interests with sovereignty concerns, the open-ended localization power may deter innovation and add compliance costs, particularly for small and medium enterprises.
Security, Breach Notification, and Accountability
The DPDP Act requires fiduciaries to implement reasonable security safeguards and to notify relevant authorities and affected principals in case of data breaches. The clarity of thresholds for notification, standards for ‘‘reasonable security,’’ and timelines will be critical to operationalize these provisions. The concept of “data audits” and compliance reports for SDFs is a welcome inclusion; however, audit standards, transparency of audit outcomes, and third-party assurance frameworks remain under-specified within the Act and subordinate rules.
Constitutional Compatibility: Puttaswamy and Beyond
The DPDP Act must be read against the constitutional commitments recognized in Puttaswamy which identify privacy as an intrinsic aspect of human dignity and autonomy.18 The Supreme Court’s framework requires that any invasion of privacy be (i) sanctioned by law, (ii) necessary for a legitimate state aim, and (iii) proportionate to that aim. [6]The DPDP Act satisfies the first limb by providing a statutory architecture for personal data processing; yet, the proportionality analysis will hinge on how the Act is interpreted and implemented particularly concerning non-consensual grounds and state access to data. The Act’s safeguards need robust procedural guarantees (independent oversight, judicial review, and transparency) to pass the demanding test of constitutionality under Puttaswamy.
Critical Appraisal
Strengths: The DPDP Act represents a clear advance over the patchwork regime that preceded it. It provides a dedicated statutory framework, recognizes a panoply of data principal rights, and creates categories of fiduciaries with calibrated obligations, thereby aligning India with international normative trends in data protection.
Weaknesses: Several features warrant concern. First, the extensive discretionary powers vested in the central government to notify categories of data, exempt certain processing, or issue rules risks executive overreach. Second, the remedies and liabilities regime limited private causes of action and capped penalties may fail to deter large corporate misconduct. Third, the Act’s enforcement architecture will require meaningful independence, technical expertise, and transparency that are not assured by the text alone. Fourth, the Act’s interplay with existing sectoral laws (such as the Information Technology Act and sectoral regulations) and state-level data needs remains underexplored.
Recommendations
To strengthen the DPDP Act and make it more consonant with constitutional privacy protections, the following reforms are recommended:
- Strengthen the Independence and Capacity of the Regulatory Authority: Ensure statutory guarantees for tenure security, budgetary autonomy, and technical staffing to shield the authority from capture and to improve enforcement capacity.
- Enhance Remedies: Introduce a robust private right of action enabling data principals to seek compensatory relief in courts, coupled with higher administrative fines calibrated to entity size and harm.
- Narrow Executive Discretion: Limit broad notification powers by prescribing clear criteria, periodic review requirements, and parliamentary oversight for localization or exemption notifications.
- Clarify Standards for Security and Audits: Issue detailed standards for “reasonable security” and third-party audit norms to increase transparency and accountability, especially for SDFs.
- Safeguard State Access: Create explicit procedural safeguards, judicial warrants, and transparency reporting for state access to personal data to ensure compatibility with Puttaswamy’s proportionality test.
Conclusion
The DPDP Act, 2023 is a landmark step for data governance in India and responds to the constitutional imperative to protect informational privacy. Yet, legislative text alone cannot guarantee robust privacy protections implementation, judicial scrutiny, and policy choices will determine whether the Act fulfils its promise. With targeted reforms to strengthen institutional independence, remedial pathways, and clarity in operational standards, the DPDP Act can evolve into a resilient framework that protects individual dignity while enabling legitimate data uses in a digital economy.
[1] The Digital Personal Data Protection Act, 2023, No. 22 of 2023 (India), Ministry of Electronics & Information Technology (MeitY), https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (official text).
[2] Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 SCC 1 (Supreme Court of India)
[3] EY India, “The Digital Personal Data Protection Act, 2023: Commentary and Analysis,” (2023), https://www.ey.com/ind/en/services/advisory/cybersecurity—privacy/ey-india-dpdp-act-2023.pdf
[4] Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 SCC 1 (Supreme Court of India)
[5] PRS Legislative Research, “Digital Personal Data Protection Bill, 2023 (Summary),” https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023.
[6] Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, “A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians,” July 2018, https://prsindia.org/files/bills_acts/bills_parliament/2019/Committee%20Report%20on%20Draft%20Personal%20Data%20Protection%20Bill%2C%202018_0.pdf.
