While the Act provides clarity to users on how their data can be used by corporations, it also provides clarity to companies (including startups) on how they must deal with users’ personal data, and consent.
In July 2017, India’s Ministry of Electronics and Information Technology (MeitY) established the Srikrishna Committee, chaired by Justice BN Srikrishna, to draft a comprehensive report on data privacy and a personal data protection bill. After six years of revisions and parliamentary procedures, the DPDP Act 2023, has now received presidential approval, marking a significant milestone in India’s data privacy landscape.
A Journey of Six Years
The journey of the DPDP Act began in 2017 when the Srikrishna Committee was formed. Over the years, the initial bill was introduced, withdrawn in August 2022, and replaced with the DPDP Bill 2023. Finally, after extensive revisions, the Act was approved by Parliament on August 9, 2023.
Key Changes and Startup Feedback
The DPDP Act 2023, introduces several changes based on feedback, especially from startups. Notably, it reduced the maximum penalty for data breaches from INR 500 Crores to INR 250 Crores. Additionally, the Act now provides a list of countries where data transactions are prohibited, offering clarity to startups handling data.
Clarity for Tech Companies
Sanjay Jain, a partner at Bharat Innovation Fund, underscores the DPDP Act’s significance for governing technology in a rapidly evolving landscape. It offers clarity on how to protect users’ rights and provides guidance to companies, including startups, on handling personal data and consent. The Act seeks to promote respect for users’ rights and control over their data across industries.
Simplifying Complexity
The DPDP Act 2023, simplifies complex aspects found in earlier drafts. For example, the Act applies to the processing of digital personal data collected within India, whether in digital or non-digital form subsequently digitised. Non-digitised personal data processing falls outside the Act’s scope.
Implementation Challenges
While the Act establishes a Data Protection Board of India for implementation, it lacks detailed guidelines, unlike the European GDPR. This poses a challenge due to the rapid pace of technology development, where regulations may lag behind emerging technologies like Generative AI.
Startup Ecosystem’s Response
Despite implementation challenges, the Indian startup ecosystem has welcomed the Act. Founders appreciate its simplicity and ease of implementation. They see it as a catalyst for a new era of data privacy and accountability in India’s digital landscape. Embracing data protection is expected to strengthen user relationships and encourage responsible innovation.
The DPDP Act 2023, represents a significant milestone in India’s data privacy landscape, acknowledging the critical importance of data protection and the government’s commitment to safeguarding user rights. As it comes into effect, it has the potential to usher in a new era of trust and innovation in the world’s third-largest startup economy.
