Why is DPDP Act 2023 needed

The new age of data protection in India

For more than two decades of the internet, India has moved at breakneck speed to go digital without the compass of a data protection law. With the Digital Personal Data Protection (DPDP) Act, a lot is about to change.

Data Protection under the old regime

Until now, there was no law or authority to regulate personal data and privacy in India. User data has been available at little cost and no liability.

Aadhar and the first echoes of Data Protection

Aadhar and personal data of Indian citizens has been leaked repeatedly. These concerns led to the Supreme Court's privacy judgement and ultimately to the Digital Personal Data Protection Act becoming law on 11 August 2023.

Putting the onus of Data Protection on businesses

The DPDP Act puts compliance obligations entirely on businesses (Data Fiduciaries), not data processors.

Under the DPDP landscape, data fiduciaries cannot simply pass the buck to data processors through indemnity clauses. Consent Managers emerge as the custodians of consent, easing the task of managing user preferences for Data Fiduciaries.