Understanding India's DPDP Act 2023: Your New Privacy Rights

An Introduction to India's New Data Privacy Era

In an era where booking a cab, ordering groceries, opening a bank account, and attending online classes happen entirely on our smartphones, personal data has become one of the most valuable resources in India. Every click, transaction, and registration leaves behind a digital footprint. For years, Indian citizens had limited control over how their personal data was collected, stored, and shared by various companies and service providers. This changed significantly with the enactment of the Digital Personal Data Protection Act, 2023, commonly known as the DPDP Act 2023.

This landmark legislation establishes a comprehensive framework to safeguard the digital privacy of Indian citizens. It balances an individual's right to protect their personal data with the lawful need of organisations to process that data for legitimate purposes. Understanding this law is no longer just for legal experts or corporate compliance teams; it is essential for every citizen who uses a smartphone, browses the internet, or shares their phone number at a retail checkout counter.

Who is Who under the DPDP Act 2023?

To understand your rights under the new law, it is helpful to familiarise yourself with the specific terminology used in the DPDP Act 2023. The law defines roles clearly so that accountability can be established without any ambiguity.

The Data Principal

Under the DPDP Act 2023, you—the individual whose personal data is being collected—are referred to as the Data Principal. If the data belongs to a child under the age of 18 or a person with a disability, their parent or lawful guardian is considered the Data Principal for all practical and legal purposes.

The Data Fiduciary

The entity, company, government department, or organisation that decides why and how your personal data is collected and processed is called the Data Fiduciary. For example, your bank, your telecom provider, your housing society management app, or an e-commerce platform are all Data Fiduciaries because they collect and manage your personal details.

The Data Processor

A Data Processor is any service provider or third-party entity that processes personal data on behalf of a Data Fiduciary. For instance, a cloud hosting service used by your bank to store account details acts as a Data Processor. Under the law, the primary responsibility for keeping your data safe remains with the Data Fiduciary.

The Core Pillar: Consent and Notice

Before the DPDP Act 2023, many organisations collected personal data through long, complex terms and conditions pages written in dense legalese that few people read. The new law completely changes this practice by making clear, unambiguous consent the foundation of data processing.

Whenever an organisation wants to collect your personal data, they must present you with an accompanying notice. This notice must be written in clear, plain language. It must explain exactly what personal data is being collected, why it is being collected, how you can exercise your privacy rights, and how you can file a complaint if you are unsatisfied. Crucially, the law mandates that this notice must be available in English as well as any of the 22 languages specified in the Eighth Schedule of the Indian Constitution, ensuring accessibility for all citizens across India.

Furthermore, your consent must be free, specific, informed, unconditional, and an unambiguous indication of your agreement. It must be given through a clear affirmative action. This means pre-ticked boxes or forced consent—where you cannot use a basic service unless you agree to share unrelated personal data—are no longer permissible. You also have the right to withdraw your consent at any time, and the process of withdrawing consent must be just as easy as it was to give it.

Your Core Privacy Rights as an Indian Citizen

The DPDP Act 2023 grants four fundamental privacy rights to every Data Principal. These rights empower you to take charge of your personal data and demand transparency from any organisation you interact with.

1. The Right to Access Information

You have the right to obtain a summary of the personal data that an organisation holds about you, along with a description of all processing activities being carried out with that data. You can also request a list of all other Data Fiduciaries and third parties with whom your personal data has been shared. This prevents companies from quietly selling or passing your information to marketing agencies without your knowledge.

2. The Right to Correction, Completion, and Erasure

If you discover that an organisation is storing incorrect, incomplete, or outdated information about you, you have the right to demand that they correct or complete it immediately. Furthermore, once the specific purpose for which you gave your consent has been fulfilled, or when you choose to withdraw your consent, you have the right to request the complete erasure of your personal data from their databases, servers, and backups.

3. The Right to Grievance Redressal

If you believe an organisation is mishandling your personal data, ignoring your consent withdrawal, or violating any provisions of the DPDP Act 2023, you have the right to register a complaint directly with them. Every Data Fiduciary must establish an easy-to-use grievance redressal mechanism. If the organisation fails to resolve your complaint within a reasonable timeframe, or if you are unsatisfied with their response, you can escalate the matter directly to the Data Protection Board of India (DPBI).

4. The Right to Nominate

In the unfortunate event of death or physical or mental incapacity, a citizen's data rights do not vanish. The DPDP Act 2023 allows you to nominate another individual who can exercise your privacy rights on your behalf. This is a crucial feature that helps protect the digital legacy and financial details of individuals who are no longer able to manage them personally.

Duties of the Citizen: Rights Come with Responsibilities

While the DPDP Act 2023 is highly consumer-centric, it also outlines specific duties for citizens to prevent the misuse of the law. As a Data Principal, you must observe certain responsibilities when exercising your privacy rights.

You must not register false or frivolous complaints against organisations. You are also prohibited from impersonating any other individual or suppressing material information when applying for state-issued documents, services, or credentials. Providing false information or making malicious, bad-faith complaints can lead to penalties specified under the law. This balance ensures that the legal system is not clogged with fake disputes while genuine grievances are addressed swiftly.

How the Law Protects Children's Data

Recognising that children are particularly vulnerable to online exploitation, profiling, and targeted advertising, the DPDP Act 2023 introduces strict protections for minors under the age of 18. Organisations are strictly prohibited from undertaking any processing of personal data that is likely to cause any harm to a child.

Before collecting or processing any personal data of a minor, a Data Fiduciary must obtain verifiable parental consent or consent from a lawful guardian. Additionally, organisations are forbidden from tracking, monitoring the behaviour of, or serving targeted advertisements directed at children. This ensures a safer digital environment for young students and teenagers across the country.

Checklist: Practical Steps to Protect Your Personal Data

While the legal framework provides robust protection, practicing good digital hygiene is your first line of defense. Use this practical checklist to safeguard your personal data in daily life:

• Audit App Permissions: Regularly check your smartphone settings. Revoke unnecessary permissions, such as location, contacts, or microphone access, for apps that do not require them to function.
• Read the Consent Notice: Before clicking "I Agree" on a website or app, spend a minute reading what data they collect and whether they share it with third parties.
• Opt-Out of Telemarketing: Use the consent withdrawal feature on apps and websites to stop receiving promotional messages and spam calls.
• Use Official Portals for Grievances: If you suspect a major data breach or identity theft, report it immediately to the national cybercrime portal at cybercrime.gov.in or call the cyber fraud helpline at 1930.
• Be Cautious Offline: Avoid writing your phone number, email address, or physical address on visitor registers or feedback forms at shopping malls and retail outlets unless absolutely necessary.

How STSS Can Help

Physical security and digital data protection go hand in hand, as physical breaches of server rooms or office premises can compromise sensitive personal data. S. Tiger Security Service (STSS) helps organisations secure their physical infrastructure using advanced Secure & Smart Access Control systems and state-of-the-art e-Surveillance Services. To secure your facility and ensure compliance with physical data protection standards, Request a security quotation from our expert security team today.