Speaker 1: Unveiling the Digital Personal Data Protection Act 2023, the new era of privacy, the Digital Personal Data Protection Act 2023, the PDPA marked a significant step towards safeguarding digital personal data in India. This comprehensive legislation aims to establish a robust framework for the processing of personal data, ensuring privacy and security for individuals, while fostering innovation and growth in the digital economy. The Digital Personal Data Protection Act 2023 1. Data Principles The DPDPA defines data principles as the individuals to whom the personal data relates. This includes children where their parents or guardians are considered data principles and individuals with disabilities where their lawful guardians act on their behalf. 2. Data Producers A data producer is an individual who alone or in conjunction with others determines the purposes and means of processing personal data. They are responsible for complying with the DPDPA's provisions and ensuring the security and privacy of personal data. 3. Data Processor A data processor is any person who processes personal data on behalf of a data fiduciary. They are bound by the terms of a valid contract with the data fiduciary and must comply with the DPDPA's requirements. 4. Consent Manager A consent manager is a person registered with the Data Production Board of India who acts as a single point of contact for data principles to view, manage, review or withdraw their concerns to the processing of their personal data. History of DPDPA 1. 2018 The Indian Government first proposed our Data Protection Bill in 2018, aiming to establish a comprehensive framework for data privacy and security. 2. 2019 The proposed bill underwent several revisions and public consultations with stakeholders providing feedback and suggestions. 3. 2023 The Digital Personal Data Protection Act of 2023 was finally enacted, incorporating key provisions for data protection and privacy, key definitions of data, representation of information, facts, concepts, opinions or instructions suitable for communication, interpretation or processing, data principles individual to whom personal data relates, including children where their parents or guardians are considered data principles and individuals with disabilities where their lawful guardians act on their behalf. 4. Data fiduciary A person who, alone or in conjunction with others, determines the purpose and means of processing personal data. 5. Data processor A person who processes personal data on behalf of a data fiduciary. 6. Personal data Any data about an individual who is identifiable by or in relation to such data processing. A wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, eraser or description. Rights of a data principal 1. Right to access information Data principals have the right to obtain information from data fiduciaries about their personal data, including the purpose of processing and the categories of data being processed. 2. Right of grievance redressal Data principals have the right to lodge grievances with the Data Protection Board of India if they believe their personal data has been processed in violation of the DPDPA. 3. Right to nominate Data principals have the right to nominate a person to act on their behalf in case of their death or incapacity, ensuring the continued protection of their personal data. Duties of a data principal 1. Provide consent Data principals have a duty to provide informed consent for the processing of their personal data, ensuring they understand the purpose and scope of the processing. 2. Withdraw consent Data principals have the right to withdraw their consent at any time with the ease of withdrawal comparable to the ease of providing consent. 3. Manage consent Data principals can manage, review, or withdraw their consent through a consent manager, a designated entity registered with the Data Protection Board of India. Grounds of processing personal data Consent data fiduciaries can process personal data based on the data principal's explicit consent, which must be free, specific, informed, unconditional, and unambiguous. Legitimate uses The DPDPA allows for certain legitimate uses of personal data, such as for research, public health, or national security purposes, provided these uses are necessary and proportionate. Processing of children's data The DPDPA imposes additional obligations on data fiduciaries when processing the personal data of children requiring parental consent and ensuring appropriate safeguards. Data Protection Board of India Establishment The DPDPA establishes the Data Protection Board of India, DPBI, an independent board responsible for enforcing the provisions of the Act. Composition The DPBI is composed of a chairperson and members appointed by the central government. The chairperson and members must possess specific qualifications and experience in data protection, law technology, and other relevant powers and functions. The DPBI has broad powers and functions, including adjudicating complaints, ensuring elections, conducting inquiries, and promoting awareness about data protection.