The Digital Personal Data Protection Act, 2023

(1) This Act may be called the Digital Personal DataProtection Act, 2023. (2) It shall come into force on such date1as the Central Government may, by notification in theOfficial Gazette, appoint and *different dates may be appointed for different provisions of this Act andany reference in any such provision to the commencement of this Act shall be construed as a referenceto the coming into force of that provision.

In this Act, unless the context otherwise requires,--- (a) "Appellate Tribunal" means the Telecom Disputes Settlement and Appellate Tribunalestablished under section 14 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997); (b) "automated" means any digital process capable of operating automatically in response toinstructions given or otherwise for the purpose of processing data; (c) "Board" means the Data Protection Board of India established by the Central Governmentunder section 18; (d) "certain legitimate uses" means the uses referred to in section 7; (e) "Chairperson" means the Chairperson of the Board; (f) "child" means an individual who has not completed the age of eighteen years; (g) "Consent Manager" means a person registered with the Board, who acts as a single point ofcontact to enable a Data Principal to give, manage, review and withdraw her consent through anaccessible, transparent and interoperable platform; (h) "data" means a representation of information, facts, concepts, opinions or instructions in amanner suitable for communication, interpretation or processing by human beings or by automatedmeans; (i) "Data Fiduciary" means any person who alone or in conjunction with other persons determinesthe purpose and means of processing of personal data; (j) "Data Principal" means the individual to whom the personal data relates and where suchindividual is--- (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf; (k) "Data Processor" means any person who processes personal data on behalf of a DataFiduciary; (l) "Data Protection Officer" means an individual appointed by the Significant Data Fiduciaryunder clause (a) of sub-section (2) of section 10; (m) "digital office" means an office that adopts an online mechanism wherein the proceedings,from receipt of intimation or complaint or reference or directions or appeal, as the case may be, tothe disposal thereof, are conducted in online or digital mode; (n) "digital personal data" means personal data in digital form; (o) "gain" means--- (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financialadvantage otherwise than by way of legitimate remuneration; (p) "loss" means--- (i) a loss in property or interruption in supply of services, whether temporary or permanent;or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financialadvantage otherwise than by way of legitimate remuneration; (q) "Member" means a Member of the Board and includes the Chairperson; (r) "notification" means a notification published in the Official Gazette and the expressions"notify" and "notified" shall be construed accordingly; (s) "person" includes--- (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub-clauses; (t) "personal data" means any data about an individual who is identifiable by or in relation tosuch data; (u) "personal data breach" means any unauthorised processing of personal data or accidentaldisclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, thatcompromises the confidentiality, integrity or availability of personal data; (v) "prescribed" means prescribed by rules made under this Act; (w) "proceeding" means any action taken by the Board under the provisions of this Act; (x) "processing" in relation to personal data, means a wholly or partly automated operation or setof operations performed on digital personal data, and includes operations such as collection,recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination,indexing, sharing, disclosure by transmission, dissemination or otherwise making available,restriction, erasure or destruction; (y) "she" in relation to an individual includes the reference to such individual irrespective ofgender; (z) "Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as maybe notified by the Central Government under section 10; (za) "specified purpose" means the purpose mentioned in the notice given by the Data Fiduciaryto the Data Principal in accordance with the provisions of this Act and the rules made thereunder;and (zb) "State" means the State as defined under article 12 of the Constitution.

Subject to the provisions of this Act, it shall--- (a) apply to the processing of digital personal data within the territory of India where the personaldata is collected--- (i) in digital form; or (ii) in non-digital form and digitised subsequently; (b) also apply to processing of digital personal data outside the territory of India, if suchprocessing is in connection with any activity related to offering of goods or services to DataPrincipals within the territory of India; (c) not apply to--- (i) personal data processed by an individual for any personal or domestic purpose; and (ii) personal data that is made or caused to be made publicly available by--- (A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in forcein India to make such personal data publicly available. Illustration. X, an individual, while blogging her views, has publicly made available her personal data on socialmedia. In such case, the provisions of this Act shall not apply.

(1) A person may process the personal data of a DataPrincipal only in accordance with the provisions of this Act and for a lawful purpose,--- (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses. (2) For the purposes of this section, the expression "lawful purpose" means any purpose which isnot expressly forbidden by law.

(1) Every request made to a Data Principal under section 6 for consent shall beaccompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informingher,--- (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section13; and (iii) the manner in which the Data Principal may make a complaint to the Board,in such manner and as may be prescribed. Illustration. X, an individual, opens a bank account using the mobile app or website of Y, a bank. To completethe Know-Your-Customer requirements under law for opening of bank account, X opts for processingof her personal data by Y in a live, video-based customer identification process. Y shall accompany orprecede the request for the personal data with notice to X, describing the personal data and the purposeof its processing. (2) Where a Data Principal has given her consent for the processing of her personal data before thedate of commencement of this Act,--- (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal anotice informing her,--- (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 andsection 13; and (iii) the manner in which the Data Principal may make a complaint to the Board,in such manner and as may be prescribed. (b) the Data Fiduciary may continue to process the personal data until and unless the DataPrincipal withdraws her consent.Illustration. X, an individual, gave her consent to the processing of her personal data for an online shopping appor website operated by Y, an e-commerce service provider, before the commencement of this Act. Uponcommencement of the Act, Y shall, as soon as practicable, give through email, in-app notification orother effective method information to X, describing the personal data and the purpose of its processing. (3) The Data Fiduciary shall give the Data Principal the option to access the contents of the noticereferred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule tothe Constitution.