THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: INDIA’S EMERGING DATA GOVERNANCE REGIME

Introduction:

India’s journey in the area of data protection law has been gradual but systematic, comprising many committee reports, draft bills & consultations over the past ten years. This journey has finally resulted in enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act), which is the first law in India that comprehensively regulates the processing of personal data online. The Act has come into force at a time when India is one of the largest countries in the world in terms of the number of internet users & many companies in the digital space, including fintech companies and government welfare services, depend on the constant processing of citizen’s personal information.[1]

This article provides a critical assessment of the DPDP Act by situating it in its constitutional history, tracing its main structural aspects & then discussing the issues that have been subjected to continuous analysis by scholars & civil society. The article concludes that although the DPDP Act is a legislative move that is certainly necessary & overdue, its current architecture focuses more on compliance with the law & flexibility of executive than achieving the intended purpose of protecting citizens’ rights based on its constitutional provisions.

The Constitutional Foundation: From Puttaswamy to DPDP Act:

To understand the legislative history behind the DPDP Act, it is important to consider the Supreme Court of India’s ruling in case of Justice K.S. Puttaswamy v Union of India, in which a nine-judge bench unanimously recognised right to privacy as intrinsic to the right to life & personal liberty under Article 21 of Constitution. The Court did not merely declare privacy a fundamental right in abstract. The Court instructed Union Government to establish a data protection regime that strikes a balance between individual privacy & legitimate government interests such as national security & welfare.[2]

The legislative reaction was neither rapid nor straightforward. A committee of experts chaired by Justice B.N. Srikrishna submitted a draft data protection bill in 2018, which formed the basis of Personal Data Protection Bill, 2019, introduced in Parliament & later examined by a Joint Parliamentary Committee. That bill was withdrawn in 2022 & a markedly reworked draft, the Digital Personal Data Protection Bill, 2022 was placed for public consultation before being passed by both Houses of Parliament in August 2023. This long-lasting journey counts in the discussion that follows: several points that advocates of privacy complained of in the bill of 2019, especially the exemptions for the authorities, escaped scrutiny & were frequently augmented in the Act while the broader rights of the bill of 2019 (such as portability of the data) vanished during the process.[3]

Structure of the Act:

Key Definitions and the Consent Architecture

The Act organises its obligations around two principal actors: the “Data Fiduciary”, being the entity that determines the purpose and means of processing personal data (analogous to a “data controller” under the GDPR) & the “Data Principal”, the individual to whom the personal data relates. The Central Government can also categorize some fiduciaries as “Significant Data Fiduciaries”, depending on the amount of information and its degree of sensitivity from the perspective of the data processed, which will increase the obligations imposed on such fiduciaries, for instance, to carry out the data protection impact assessment or appoint the Data Protection Officer. The use of the personal data is allowed only if the Data Principal has provided a free, clear & well-informed consent or if the use of data is in accordance with one of the uses enumerated in the Act.[4]

The Data Protection Board of India

The responsibility for implementing the law is placed with the Data Protection Board of India, a legal institution qualified to oversee enforcement, carry out investigations, issue directives for corrective actions & impose fines. Board members are appointed by the central government and hence are subject to similar terms and conditions imposed upon them by the government. This institutional arrangement, as will be demonstrated in Part IV has been criticized for lack of independence.[5]

Cross-Border Data Transfer and the Moderation of Localisation

The Act softens the strict data-localisation stance of its predecessor of 2019 in the sense that it allows for the transfer of personal data from India, subject to Government’s power to restrict transfers to specific countries by notification. This differs from the GDPR ‘adequacy’ system, which limits any transfers to non-EEA countries unless the adequacy of the recipient country is positively determined or some protection mechanism, such as standard contractual clauses, is in place. This more flexible solution allows India to stay competitive in the area of data storage, while other laws, such as RBI’s localisation requirements, have their own regulations & work alongside the Act.[6]

Enforcement and Penalties

The Board has the power to impose fines in the amount of several hundred crores of rupees in case it observes the failure of an entity in adhering to reasonable security practices with small fines for other violations as well, including the ones related to data of children. The existing above tribunal has been redesigned for this purpose.[7]

Critical Fault Lines

The Exemption System for the Government

Section 17 is definitely the part of the Act that has been disputed the most. Section 17(1)(c) states that processing meant for the purpose of preventing, discovering, investigating, and/or prosecuting the crimes is exempted from consent & notice. Section 17(2)(a) states that the Government has a right to exempt the whole Act’s application on the basis of its sovereignty, security, international relations & public security. However, since Section 17(1)(c) already covers investigation, the existence of another exemption clearly means that there are some categories of action that state authorities intentionally seek to place beyond the scope of the Act. There is also Section 17(5) that permits the government to grant any exemption from any provision of this Act within five years and for any time.[8]

Independence of the Data Protection Board

The Board has come in for significant criticism for being far from the independent authority, i.e. the Data Protection Authority, that the 2019 legislation expected. This is on account of the government playing an enabling role in the appointment of Board members as well as framing the rules governing the functioning of the Board. This further means that the Board’s ability of independently adjudicating against the actions of government fiduciaries is unambiguously unproven. With the addition of Section 37, a novel provision which did not exist in the previous drafts, the Board can now refer to the government to issue directives about blocking public access to information relating to goods & services provided by any fiduciary in India. However, the very relevance of this power in relation to the issue of data privacy is questionable.[9]

The DPDP Act and the Erosion of the RTI Regime

According to Section 44(3) of the RTI Act, Section 8(1)(j) has been modified with respect to the provisions it contained relating to the disclosure of information. In particular, it has replaced the phrase which allowed exemptions based on the Public Information Officer’s determination of large public interests with regard to disclosure of information. The Supreme Court had previously ruled in CPIO, Supreme Court of India v Subhash Chandra Agarwal that Section 8(1)(j) required the use of the proportionality test in order to determine whether privacy concerns should weigh against public interest concerns.[10] It is learned that the amendment has removed the requirement for performing proportionality tests under Section 8(1)(j), which has resulted in the weakening of the existing balance. This casting down of important principles of the law of torts, appearing through the recent amendments, seems ironic in view of the fact that the Act was originally created as a result of the judgment of Puttaswamy.[11]

This is not just too technical. In March 2026, opposition head Jairam Ramesh asked the government to stop, review & repeal Section 44(3). The IT minister replied that all personal information that had been disclosed pursuant to any laws of a different nature would still be available under Section 3. People criticize that Section 3 applies only to information made public by an individual or to information an individual had to disclose and does not reintroduce the public interest law required by the amendment so one cannot say that the issue is resolved.[12]

Absence of Data Portability and a Distinct Sensitive-Data Category

The DPDP Act does not provide the right of data portability which is included in the GDPR, wherein individuals easily switch data from one service provider to another through a system that is also structured. Moreover, the right of portability was removed from the 2019 DPDP bill. Furthermore, comparative analysis indicates that there is no definition of sensitive personal data in the DPDP Act where the data is being protected in some specific way similar to the situation in the GDPR as well as in the 2024 American Privacy Rights Act.[13]

A Comparative Lens: DPDP Act and GDPR

In terms of its basic conceptual framework, the DPDP Act is similar to the GDPR in terms of its use of the category of the fiduciary/controller and the primary/subject, as well as in terms of its reliance on consent as a legal basis. The two regimes differ in their underlying principle. The GDPR is clearly rights-based, spelling out various rights such as access, rectification, erasure, restriction, portability, and the right to object to automated decision-making. By contrast, the rights under the DPDP Act are narrower in scope, confined to access, correction and erasure, grievance redress, and appointment of representatives upon death or incapacity. A European analysis concludes that the Act as it currently stands is likely not to achieve the GDPR “adequacy” threshold, and that therefore there will be additional measures needed for EU-India data flows, such as standard contractual clauses. These findings imply that the DPDP Act is likely drafted with a view to the Indian digital economy at the expense of the rights orientation of the European legislation.[14]

Implementing Timeline: The DPDP Regulations and 2027

The Act implementation has happened in phases with certain definitions, the constitution of the Board along with certain procedural aspects having been made operational in November 2025 along with DPDP rules which enabled various crucial aspects like the consent-notice requirement, breach reporting, and the functioning of the Board. As for the verifiable consent process it is set to come into action in November 2026. The remaining essential regulations are to be implemented in May 2026. While this stepwise process is beneficial from the business process compliance perspective especially for SMEs, it implies that there are still various transitional matters concerning the framework.[15]

Conclusion and Recommendations

The DPDP Act is a true landmark legislation: after nearly ten years of discussions following Puttaswamy, India has finally a comprehensive data protection legislation, imposing major duties with respect to consent, breach reporting and security, none of which were covered in previous laws. However, the success of the Act is limited compared to what had been anticipated at constitutional level. Numerous exemptions granted by Section 17, the establishment of a Board appointed by the government, narrowed scope of RTI proportionality test, as well as absence of data portability and provisions for protection of sensitive data are clear evidence of an Act that is not aimed at putting individuals at the centre of data governance but rather at enabling data-driven governance and business.

At least three reforms must be made to improve the provisional framework without changing anything fundamental. First, the exemptions provided under Section 17(2)(a) may be made subject to periodic parliamentary or judicial review and could also include an upper limit for exemptions under Section 17(5). Second, appointments to the Board may be insulated from the executive, e.g. by employing a selection committee that may include a representative from the judiciary, thus providing an earlier level of independence to the Data Protection Authority. Third, the Rules may create a special category for protection of sensitive personal information and the right to partial portability, avoiding any possibility of excessive compliance burden imposed under GDPR. The fate of the Act would depend on these three measures as its other provisions begin to operate in full by 2027.[16]

BIBLIOGRAPHY

Statutes:

The Digital Personal Data Protection Act, No. 22 of 2023, Acts of Parliament, 2023 (India).

Case Laws:

Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal, 2019 SCC OnLine SC 1459.

Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

Secondary Sources:

Adyasha Behera & Bhanu Pratap Singh, Safeguarding Privacy in the Digital Era: Balancing Rights, Security, and Innovation, 5 CHANAKYA L. REV. 57 (2024).

Deepa Raghavan, Analysis of India’s Digital Personal Data Protection (DPDP) Act, 2023, GEOJURISTTODAY (Dec. 11, 2025).

Kalpana V. Jawale, The Digital Personal Data Protection Act, 2023: Balancing the Right to Privacy and State Surveillance in India, 6 INT’L J. L. JUST. & JURIS. 15 (2026).

Lalit Kalra, Decoding the Digital Personal Data Protection Act, 2023, EY India (Nov. 21, 2025).

LATHAM & WATKINS LLP, INDIA’S DIGITAL PERSONAL DATA PROTECTION ACT 2023 VS. THE GDPR: A COMPARISON (2026).

Pratiksha Pravin Barve, Legal Framework on Digital Data Protection and Privacy – Emerging Challenges, 2 INT’L J. L. RES. & ANALYSIS 30 (2024).

Pawan Dubey, The Digital Personal Data Protection Act, 2023: Balancing Privacy, Innovation, and State Power in India, L. JURIST (June 22, 2026).

Richa Ranjan, Shailja Vasudeva & Satinder Kaur, Between Privacy and Power: A Critical Look at the Digital Personal Data Protection Act, 2023, 12 J. EMERGING TECH. & INNOVATIVE RES. i60 (2025).

[1] Pawan Dubey, The Digital Personal Data Protection Act, 2023: Balancing Privacy, Innovation, and State Power in India, L. JURIST (June 22, 2026).

[2] Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

[3] Dubey, supra note 1.

[4] Richa Ranjan, Shailja Vasudeva & Satinder Kaur, Between Privacy and Power: A Critical Look at the Digital Personal Data Protection Act, 2023, 12 J. EMERGING TECH. & INNOVATIVE RES. i60 (2025).

[5] Adyasha Behera & Bhanu Pratap Singh, Safeguarding Privacy in the Digital Era: Balancing Rights, Security, and Innovation, 5 CHANAKYA L. REV. 57 (2024).

[6] Lalit Kalra, Decoding the Digital Personal Data Protection Act, 2023, EY India (Nov. 21, 2025).

[7] Id.

[8] Pratiksha Pravin Barve, Legal Framework on Digital Data Protection and Privacy – Emerging Challenges, 2 INT’L J. L. RES. & ANALYSIS 30 (2024).

[9] Data Protection and Privacy Issue in India: An Analysis of the Digital Personal Data Protection Act, 2023, LAWCTOPUS ACADEMIKE.

[10] Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal, 2019 SCC OnLine SC 1459.

[11] Ranjan et al., supra note 4.

[12] Id.

[13] Barve, supra note. 7

[14] LATHAM & WATKINS LLP, INDIA’S DIGITAL PERSONAL DATA PROTECTION ACT 2023 VS. THE GDPR: A COMPARISON (2026).

[15] Deepa Raghavan, Analysis of India’s Digital Personal Data Protection (DPDP) Act, 2023, GEOJURISTTODAY (Dec. 11, 2025).

[16] Kalpana V. Jawale, The Digital Personal Data Protection Act, 2023: Balancing the Right to Privacy and State Surveillance in India, 6 INT’L J. L. JUST. & JURIS. 15 (2026).