Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
Approach · directive: “describe”
What it asks · Explain why India needed a data-protection law and list its main provisions.
The question has 2 parts — answer each
- Describe the context of the DPDP Act 2023: the privacy judgment, committee, earlier Bills and the digital economy's needs
- Describe its salient features: scope, consent, rights, duties, children, cross-border transfer, Board, penalties and exemptions
Open with · The Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection law a constitutional necessity.
Cover
- Context: a large digital economy, data breaches, the Justice B.N. Srikrishna Committee (2018) and the withdrawn 2019 Bill.
- Scope: digital personal data processed in India, and abroad if it involves offering goods or services to people in India.
- Consent and notice, with defined 'legitimate uses'; Data Principals get rights to access, correction, erasure, grievance redress and nomination.
- Data Fiduciaries must secure data and report breaches; Significant Data Fiduciaries need a data protection officer, audits and impact assessments.
- Children's data needs verifiable parental consent; tracking and targeted advertising at children are barred.
- Cross-border transfer allowed except to notified countries; Data Protection Board adjudicates; wide exemptions for the State are criticised.
Close with · The Act is a strong start; its credibility will depend on an independent Board, narrow State exemptions and careful implementation.
Add value (verified)
- The Act's Schedule sets its highest penalty — up to ₹250 crore — for a Data Fiduciary's failure to take reasonable security safeguards against a personal data breach. The Digital Personal Data Protection Act, 2023 (MeitY) ↗“May extend to two hundred and fifty crore rupees.”
- Since then: the DPDP Rules, 2025 were notified on 14 November 2025, operationalising the Act. PIB — DPDP Rules, 2025 Notified (17 November 2025) ↗“The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025.”
Question: UPSC's CS (Main) 2024, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 30 Sept 2026 (how we verify) — UPSC publishes no model answers. ·
Model answer · 214 words (UPSC limit 150) · Minimalist IAS
The Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection statute a constitutional necessity; the Digital Personal Data Protection Act, 2023 is India's first such law.
Context
- A vast digital economy — Aadhaar, UPI and platforms processing personal data — with recurring breaches; the Justice B.N. Srikrishna Committee (2018), whose draft became the 2019 Bill, withdrawn in 2022 after a Joint Parliamentary Committee review.
Salient features
- Scope: digital personal data processed in India, and abroad when goods or services are offered to people in India.
- Consent-based processing with clear notice, plus defined 'legitimate uses'; Data Principals get rights of access, correction, erasure, grievance redress and nomination.
- Duties: Data Fiduciaries must secure data and report breaches; Significant Data Fiduciaries need a data protection officer, audits and impact assessments.
- Children: verifiable parental consent, with tracking and targeted advertising barred.
- Cross-border transfer allowed except to countries the Centre notifies.
- Enforcement: a Data Protection Board adjudicates; penalties up to ₹250 crore for failing to prevent breaches.
- Concerns: wide exemptions for the State, an executive-appointed Board, and dilution of the RTI Act's personal-information clause.
The Act is a strong start (its Rules were notified on 14 November 2025); its credibility now rests on an independent Board, narrow State exemptions and careful implementation.
Written by Minimalist IAS from facts checked at source (how we verify) — a little fuller than exam length, so every part of the question is covered; in the hall, keep the structure and trim the detail. UPSC publishes no model answers: compare your structure and coverage with this, then write your own.