India’s journey to regulate data privacy has been bumpy to say the least. Back in 2017, the Supreme Court of India held that right to privacy is a fundamental right and directed the Indian Government to implement a new law relating to data privacy. From 2018 to 2022, the Government made a total of four attempts to introduce a cross-sectoral data privacy law in India. These versions of the proposed law were scrapped as big tech companies raised concerns ranging from exorbitant costs associated with personal data processing requirements to strict restrictions on cross-border data transfers.

In what is believed to be the Government’s conclusive attempt to regulate data privacy, the Indian Parliament passed the Digital Personal Data Protection Act, 2023 (DPDP Act) in August 2023. Notably, while the DPDP Act has received presidential assent, provisions of the DPDP Act have not yet come into force. News reports suggest that the Government is in the process of crystallizing rules to the DPDP Act, following which provisions may come into force in a phased manner. The term ‘digital personal data’ is the entryway to the application of the DPDP Act

In this first article in the DPDP Act Series, we will dive into the ambit of ‘digital personal data’ under the DPDP Act.

Read the full article authored by Managing Partner Nusrat Hassan, Partner Ambuj Sonal and Senior Associate Meghna Punjabi on Lexology and Chambers and Partners.