Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
Approach · directive: “describe”
What it asks · Explain why India needed a data-protection law and list its main provisions.
It asks 2 things — answer each
- Describe the context of the DPDP Act 2023: the privacy judgment, committee, earlier Bills and the digital economy's needs
- Describe its salient features: scope, consent, rights, duties, children, cross-border transfer, Board, penalties and exemptions
Open with · Constitutional background: the Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection statute a constitutional necessity; the DPDP Act 2023 is India's first such law.
Cover
- Context: Puttaswamy (2017), a large digital economy with breaches, the Justice B.N. Srikrishna Committee (2018), the 2019 Bill withdrawn in 2022 after JPC review.
- Scope: digital personal data processed in India, and abroad if goods or services are offered to people in India.
- Consent and 'legitimate uses' (Section 7); rights to access, correction, erasure, grievance redress and nomination; Consent Managers registered with the Board.
- Duties: Data Fiduciaries secure data and report breaches; Significant Data Fiduciaries need a DPO, audits and impact assessments.
- Children: under 18; verifiable parental consent; tracking and targeted advertising barred.
- Cross-border transfer allowed except to notified countries (Section 16); Data Protection Board adjudicates; penalties up to ₹250 crore.
- Concerns: wide State exemptions, executive-appointed Board, Section 44(3) narrowing RTI Act clause 8(1)(j) to 'information which relates to personal information'.
Close with · With its Rules notified on 14 November 2025, the Act's credibility rests on an independent Board and on State exemptions that honour the privacy standard Puttaswamy set.
Add value (verified)
- The Act's Schedule sets its highest penalty — up to ₹250 crore — for a Data Fiduciary's failure to take reasonable security safeguards against a personal data breach.The Digital Personal Data Protection Act, 2023 (MeitY) ↗“May extend to two hundred and fifty crore rupees.”
- Since then: the DPDP Rules, 2025 were notified on 14 November 2025, operationalising the Act.PIB — DPDP Rules, 2025 Notified (17 November 2025) ↗“The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025.”
- DPDP Act 2023, Section 2(f): a child is an individual who has not completed eighteen years.The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY), Section 2(f) ↗““child” means an individual who has not completed the age of eighteen years”
- DPDP Act 2023, Section 9(1): verifiable consent of the parent or lawful guardian is required before processing a child's personal data.The Digital Personal Data Protection Act, 2023, Section 9(1) ↗“The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.”
- DPDP Act 2023, Section 2(g): a Consent Manager is registered with the Board and acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent.The Digital Personal Data Protection Act, 2023, Section 2(g) ↗““Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent”
- DPDP Act 2023, Section 16(1): the Centre may by notification restrict transfer of personal data to notified countries or territories outside India.The Digital Personal Data Protection Act, 2023, Section 16(1) ↗“The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.”
- DPDP Act 2023, Section 44(3): substitutes RTI Act Section 8(1)(j) with 'information which relates to personal information'.The Digital Personal Data Protection Act, 2023, Section 44(3) (amendment of the Right to Information Act, 2005) ↗“In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:— “(j) information which relates to personal information;”.”
Question: UPSC's CS (Main) 2024, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·
Model answer· 227words · Minimalist IAS
The Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection law a constitutional necessity; the Digital Personal Data Protection Act, 2023 is India's first.
Context
- Scale and long gestation: a vast digital economy with recurring breaches; the Justice B.N. Srikrishna Committee (2018) drafted the 2019 Bill, withdrawn in 2022 after Joint Parliamentary Committee review.
- 2017: Puttaswamy judgment
- 2018: Srikrishna draft
- 2019: PDP Bill
- 2022: Bill withdrawn
- 2023: DPDP Act
Salient features
- Scope: digital personal data processed in India, or abroad when serving people in India.
- Consent and rights: notice-based consent plus 'legitimate uses' (Section 7); rights to access, correct, erase, redress and nominate; Consent Managers registered with the Board to give and withdraw consent.
- Duties: Data Fiduciaries secure data and report breaches; Significant ones need a data protection officer, audits and impact assessments.
- Children: under 18; verifiable parental consent; no tracking or targeted advertising.
- Cross-border: allowed except to countries the Centre notifies (Section 16).
- Enforcement: a Data Protection Board adjudicates; penalties up to ₹250 crore for failing to take reasonable security safeguards.
- Concerns: wide State exemptions, an executive-appointed Board, and Section 44(3) narrowing RTI clause 8(1)(j) to 'information which relates to personal information'.
Since then, with its Rules notified on 14 November 2025, the Act's credibility rests on an independent Board and State exemptions honouring the privacy standard Puttaswamy set.
Prepared by Minimalist IAS to the answer standard of Shivam Singh (mentor, 7 years) · facts checked against official sources (how we verify) · updated 3 Oct 2026. UPSC publishes no model answers: compare your structure and coverage with this, then write your own.
