IndiaDigital Personal Data Protection Act, 2023, comprehensive regime and lawful basis
Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Under India's Digital Personal Data Protection Act, an app that collects, uses, or discloses the personal data of an individual in India, including a voiceprint, faceprint, or other biometric identifier, which the Act treats as ordinary personal data since it has no separate sensitive-category tier, needs a lawful basis under section 4, ordinarily the data principal's free, specific, informed, and unambiguous consent under section 6, or one of section 7's enumerated legitimate uses.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- Does section 3(c)(ii)(A), which takes outside the Act personal data 'made or caused to be made publicly available' by the Data Principal, also exempt a third party that collects that data from the public source, or only the publication by the Data Principal herself?
- What must a Data Principal do to have 'indicated to the Data Fiduciary that she does not consent to the use of her personal data' under section 7(a), and does a later withdrawal of consent count?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Where consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that a notice was given and that consent was given in accordance with the Act and the rules. A Data Fiduciary can discharge that burden only from a record of the notice and the consent. Section 8(7) on erasure limits how long personal data is kept and is not a retention period for a record. The sections cited here carry no territorial clause; section 3, which sets the Act's reach, is not cited by this row.
- Kind
- Implicit
- As of
- Provision
- Section 6(10)
- Trigger
- consent_or_optout
What this law does
The DPDPA is India's first comprehensive personal-data statute, defining "personal data" broadly and technology-neutrally as any data about an identifiable individual (s.2(t)), with no separate sensitive or special-category tier for any kind of data, biometric included.
A Data Fiduciary must have a lawful basis under s.4 before processing, ordinarily the data principal's free, specific, informed, unconditional and unambiguous consent under s.6, or one of s.7's enumerated legitimate uses (voluntarily-provided data for a specified purpose, state functions, employment, medical emergency). A Data Fiduciary bears general erasure (s.8(7)) and security-safeguard (s.8(5)) duties.
None of ss.4, 6, 7, or 8 have commenced: Notification G.S.R. 843(E) () appoints eighteen months from its own publication date, , as their commencement date under clause (c); that calendar date is arithmetic on the notification's own offset, not a separately printed date. Section 2's definitions, by contrast, came into force on the notification's publication date itself, , under clause (a).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .