ZipLaw
Bare Act Reader DPDP Act
DPDP Act Act No. 22 of 2023

The Digital Personal Data Protection Act, 2023

The bare text of the Digital Personal Data Protection Act, 2023.

44 Sections
9 Chapters
Rs. 250 crore Penalty cap
Digital office Board
Act No. 22 of 2023 Enacted 11 August 2023 Enforced Phased from 13 November 2025 Ministry of Electronics and Information Technology DPDP commencement and corrigendum references
45 sections visible
Default readable text
Opening text

Preamble

An Act to provide for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of digital personal dataDefined in section 2(n): digital personal data means personal data in digital form in a manner that recognises both the right of individuals to protect their personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and the need to process such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for lawful purposes and for matters connected therewith or incidental thereto.
BE it enacted by Parliament in the Seventy-fourth Year of the Republic of India as follows:-
Chapter I

Preliminary

3 sections
S. 1 Short title and commencement
Open section
1. (1) This Act may be called the Digital Personal DataDefined in section 2(n): digital personal data means personal data in digital form Protection Act, 2023
(2) It shall come into force on such date as the Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision
S. 2 Definitions
Open section
2. In this Act, unless the context otherwise requires,-
(a) "Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997" means the Telecom Disputes Settlement and Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 established under section 14 of the Telecom Regulatory Authority of India Act, 1997;
(b) "automatedDefined in section 2(b): automated means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data" means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means;
(c) "BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18" means the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of India established by the Central Government under section 18;
(d) "certain legitimate usesDefined in section 2(d): certain legitimate uses means the uses referred to in section 7" means the uses referred to in section 7;
(e) "ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board" means the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18;
(f) "childDefined in section 2(f): child means an individual who has not completed the age of eighteen years" means an individual who has not completed the age of eighteen years;
(g) "Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform" means a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses registered with the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, who acts as a single point of contact to enable a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;
(h) "dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by human beings or by automatedDefined in section 2(b): automated means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data means;
(i) "Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data" means any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who alone or in conjunction with other persons determines the purpose and means of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data;
(j) "Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf" means the individual to whom the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data relates and where such individual is-
(i) a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years, includes the parents or lawful guardian of such a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years;
(ii) a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses with disability, includes her lawful guardian, acting on her behalf;
(k) "Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary" means any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who processes personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data on behalf of a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
(l) "Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10" means an individual appointed by the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... under clause (a) of sub-section (2) of section 10;
(m) "digital officeDefined in section 2(m): digital office means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode" means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode;
(n) "digital personal dataDefined in section 2(n): digital personal data means personal data in digital form" means personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data in digital form;
(o) "gainDefined in section 2(o): gain means (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration" means -
(i) a gainDefined in section 2(o): gain means (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration in property or supply of services, whether temporary or permanent; or
(ii) an opportunity to earn remuneration or greater remuneration or to gainDefined in section 2(o): gain means (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration a financial advantage otherwise than by way of legitimate remuneration;
(p) "lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration" means--
(i) a lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration in property or interruption in supply of services, whether temporary or permanent; or
(ii) a lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration of opportunity to earn remuneration or greater remuneration or to gainDefined in section 2(o): gain means (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration a financial advantage otherwise than by way of legitimate remuneration;
(q) "MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson" means a MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and includes the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board;
(r) "notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly" means a notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly published in the Official Gazette and the expressions "notify" and "notified" shall be construed accordingly;
(s) "personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses" includes
(i) an individual;
(ii) a Hindu undivided family;
(iii) a company;
(iv) a firm;
(v) an association of persons or a body of individuals, whether incorporated or not;
(vi) the State; and
(vii) every artificial juristic personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses, not falling within any of the preceding sub-clauses;
(t) "personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data" means any dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means about an individual who is identifiable by or in relation to such dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means;
(u) "personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data" means any unauthorised processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data or accidental disclosure, acquisition, sharing, use, alteration, destruction or lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration of access to personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, that compromises the confidentiality, integrity or availability of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data
(v) "prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act" means prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act by rules made under this Act;
(w) "proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act" means any action taken by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under the provisions of this Act;
(x) "processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure..." in relation to personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, means a wholly or partly automatedDefined in section 2(b): automated means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data operation or set of operations performed on digital personal dataDefined in section 2(n): digital personal data means personal data in digital form, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction
(y) "sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender" in relation to an individual includes the reference to such individual irrespective of gender;
(z) "Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules..." means any Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries as may be notified by the Central Government under section 10
(za) "specified purpose" means the purpose mentioned in the notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in accordance with the provisions of this Act and the rules made thereunder; and
(zb) "State" means the State as defined under article 12 of the Constitution.
S. 3 Application of Act
Open section
3. Subject to the provisions of this Act, it shall
(a) apply to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of digital personal dataDefined in section 2(n): digital personal data means personal data in digital form within the territory of India where the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is collected
(i) in digital form; or
(ii) in non-digital form and digitised subsequently;
(b) also apply to processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of digital personal dataDefined in section 2(n): digital personal data means personal data in digital form outside the territory of India, if such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is in connection with any activity related to offering of goods or services to DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals within the territory of India;
(c) not apply to-
(i) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed by an individual for any personal or domestic purpose; and
(ii) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that is made or caused to be made publicly available by-
(A) the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to whom such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data relates; or
(B) any other personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who is under an obligation under any law for the time being in force in India to make such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data publicly available.
Illustration.
X, an individual, while blogging her views, has publicly made available her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data on social media. In such case, the provisions of this Act shall not apply
Chapter II

Obligations of Data Fiduciary

7 sections
S. 4 Grounds for processing personal data
Open section
4. (1) A personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf only in accordance with the provisions of this Act and for a lawful purpose,-
(a) for which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf has given her consent; or
(b) for certain legitimate usesDefined in section 2(d): certain legitimate uses means the uses referred to in section 7.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.
S. 5 Notice
Open section
5. (1) Every request made to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf under section 6 for consent shall be accompanied or preceded by a notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, informing her,-
(i) the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and the purpose for which the same is proposed to be processed;
(ii) the manner in which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender may exercise her rights under sub-section (4) of section 6 and section 13; and
(iii) the manner in which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf may make a complaint to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, in such manner and as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act
Illustration.
X, an individual, opens a bank account using the mobile app or website of Y, a bank. To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data with notice to X, describing the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and the purpose of its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure....
(2) Where a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf has given her consent for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data before the date of commencement of this Act,-
(a) the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, as soon as it is reasonably practicable, give to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf a notice informing her,-
(i) the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and the purpose for which the same has been processed;
(ii) the manner in which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender may exercise her rights under sub-section (4) of section 6 and section 13; and
(iii) the manner in which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf may make a complaint to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18,
(b) the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data may continue to process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data until and unless the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf withdraws her consent.
Illustration.
X, an individual, gave her consent to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for an online shopping app or website operated by Y, an e-commerce service provider, before the commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give through email, in-app notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly or other effective method information to X, describing the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and the purpose of its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure....
(3) The Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall give the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution.
S. 6 Consent
Open section
6. (1) The consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the specified purpose and be limited to such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data as is necessary for such specified purpose.
Illustration
X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for making available telemedicine services.
(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
Illustration
X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. SheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender gives to Y her consent for (i) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.
(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10, where applicable, or of any other personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses authorised by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to respond to any communication from the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf for the purpose of exercise of her rights under the provisions of this Act.
(4) Where consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf is the basis of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, and such withdrawal shall not affect the legality of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data based on consent before its withdrawal.
Illustration
X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... for supply of the goods already ordered and paid for by X.
(6) If a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf withdraws her consent to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data under sub-section (5), the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, within a reasonable time, cease and cause its DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Processors to cease processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf unless such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... without her consent is required or authorised under the provisions of this Act Consent. or the rules made thereunder or any other law for the time being in force in India
Illustration
X, a telecom service provider, enters into a contract with Y, a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of Z for emailing bills.
(7) The Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf may give, manage, review or withdraw her consent to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data through a Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
(8) The Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform shall be accountable to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and shall act on her behalf in such manner and subject to such obligations as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(9) Every Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform shall be registered with the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 in such manner and subject to such technical, operational, financial and other conditions as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(10) Where a consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf is the basis of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and a question arises in this regard in a proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act, the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall be obliged to prove that a notice was given by her to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and consent was given by such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data in accordance with the provisions of this Act and the rules made thereunder.
S. 7 Certain legitimate uses
Open section
7. A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data may process personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf for any of following uses, namely:-
(a) for the specified purpose for which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf has voluntarily provided her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, and in respect of which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has not indicated to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data that sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender does not consent to the use of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
Illustration
(I) X, an individual, makes a purchase at Y, a pharmacy. SheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender voluntarily provides Y her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X for the purpose of sending the receipt.
(II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for this purpose. Y may process her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X;
(b) for the State and any of its instrumentalities to provide or issue to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf such subsidy, benefit, service, certificate, licence or permit as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, where-
(i) sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has previously consented to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or
(ii) such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government,
subject to standards followed for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
Illustration
X. a pregnant woman, enrols herself on an app or website to avail of government's maternity benefits programme, while consenting to provide her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the purpose of availing of such benefits. Government may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... to determine her eligibility to receive any other prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act benefit from the government;
(c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State;
(d) for fulfilling any obligation under any law for the time being in force in India on any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses to disclose any information to the State or any of its instrumentalities, subject to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force;
(e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India;
(f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf or any other individual;
(g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health;
(h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order
Explanation.-For the purposes of this clause, the expression "disaster" shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005; or
(i) for the purposes of employment or those related to safeguarding the employer from lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf who is an employee.
S. 8 General obligations of Data Fiduciary
Open section
8. (1) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, irrespective of any agreement to the contrary or failure of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... undertaken by it or on its behalf by a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
(2) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data may engage, appoint, use or otherwise involve a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary to process personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data on its behalf for any activity related to offering of goods or services to DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals only under a valid contract
(3) Where personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data is likely to be-
(a) used to make a decision that affects the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf; or
(b) disclosed to another Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data,
the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data shall ensure its completeness, accuracy and consistency.
(4) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.
(5) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall protect personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data in its possession or under its control, including in respect of any processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... undertaken by it or on its behalf by a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary, by taking reasonable security safeguards to prevent personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
(6) In the event of a personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data, the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall give the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and each affected Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, intimation of such breach in such form and manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(7) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, unless retention is necessary for compliance with any law for the time being in force,-
(a) erase personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, upon the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and
(b) cause its Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary to erase any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that was made available by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... to such Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
Illustration
(I) X, an individual, registers herself on an online marketplace operated by Y, an e-commerce service provider. X gives her consent to Y for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for selling her used car. The online marketplace helps conclude the sale. Y shall no longer retain her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
(II) X, an individual, decides to close her savings account with Y, a bank. Y is required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X's personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the said period
(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf does not--
(a) approach the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for the performance of the specified purpose; and
(b) exercise any of her rights in relation to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure....
for such time period as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, and different time periods may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act for different classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries and for different purposes.
(9) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall publish, in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, the business contact information of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10, if applicable, or a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who is able to answer on behalf of the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, the questions, if any, raised by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf about the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
(10) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall establish an effective mechanism to redress the grievances of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals.
(11) For the purposes of this section, it is hereby clarified that a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall be considered as not having approached the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for the performance of the specified purpose, in any period during which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has not initiated contact with the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for such performance, in personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses or by way of communication in electronic or physical form.
S. 9 Processing of personal data of children
Open section
9. (1) The Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, before processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years or a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses with disability who has a lawful guardian obtain verifiable consent of the parent of such childDefined in section 2(f): child means an individual who has not completed the age of eighteen years or the lawful guardian, as the case may be, in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
Explanation.-For the purpose of this sub-section, the expression "consent of the parent" includes the consent of lawful guardian, wherever applicable.
(2) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall not undertake such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that is likely to cause any detrimental effect on the well-being of a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years.
(3) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
(4) The provisions of sub-sections (1) and (3) shall not be applicable to processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years by such classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries or for such purposes, and subject to such conditions, as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(5) The Central Government may, if satisfied that a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data has ensured that its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of children is done in a manner that is verifiably safe, notify for such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data the age above which that Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by that Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data as the notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly may specify
S. 10 Additional obligations of Significant Data Fiduciary
Open section
10. (1) The Central Government may notify any Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries as Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules..., on the basis of an assessment of such relevant factors as it may determine, including-
(a) the volume and sensitivity of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed;
(b) risk to the rights of Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf
(c) potential impact on the sovereignty and integrity of India;
(d) risk to electoral democracy;
(e) security of the State; and
(f) public order
(2) The Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... shall-
(a) appoint a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10 who shall-
(i) represent the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... under the provisions of this Act
(ii) be based in India
(iii) be an individual responsible to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of Directors or similar governing body of the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules...; and
(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;
(b) appoint an independent dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means auditor to carry out dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means audit, who shall evaluate the compliance of the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... in accordance with the provisions of this Act; and
(c) undertake the following other measures, namely:-
(i) periodic DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection Impact Assessment, which shall be a process comprising a description of the rights of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals and the purpose of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of their personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, assessment and management of the risk to the rights of the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals, and such other matters regarding such process as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act;
(ii) periodic audit; and
(iii) such other measures, consistent with the provisions of this Act, as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
Chapter III

Rights and Duties of Data Principal

5 sections
S. 11 Right to access information about personal data
Open section
11.(1) The Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to obtain from the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to whom sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data), for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, upon making to it a request in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act,-
(a) a summary of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data which is being processed by such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data and the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... activities undertaken by that Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data with respect to such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data;
(b) the identities of all other DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries and DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Processors with whom the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data has been shared by such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, along with a description of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data so shared; and
(c) any other information related to the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure..., as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(2)Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by the said Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data with any other Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data authorised by law to obtain such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, where such sharing is pursuant to a request made in writing by such other Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.
S. 12 Right to correction and erasure of personal data
Open section
12. (1) A Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to correction, completion, updating and erasure of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.
(2) A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, upon receiving a request for correction, completion or updating from a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf,-
(a) correct the inaccurate or misleading personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data
(b) complete the incomplete personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data; and
(c) update the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data
(3) A Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall make a request in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for erasure of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, and upon receipt of such a request, the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall erase her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.
S. 13 Right of grievance redressal
Open section
13. (1) A Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to have readily available means of grievance redressal provided by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform in respect of any act or omission of such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform regarding the performance of its obligations in relation to the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf or the exercise of her rights under the provisions of this Act and the rules made thereunder.
(2) The Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform shall respond to any grievances referred to in sub-section (1) within such period as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act from the date of its receipt for all or any class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries.
(3) The Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall exhaust the opportunity of redressing her grievance under this section before approaching the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18
S. 14 Right to nominate
Open section
14. (1) A Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to nominate, in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, any other individual, who shall, in the event of death or incapacity of the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, exercise the rights of the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in accordance with the provisions of this Act and the rules made thereunder.
(2) For the purposes of this section, the expression "incapacity" means inability to exercise the rights of the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.
S. 15 Duties of Data Principal
Open section
15. A Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall perform the following duties, namely:-
(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
(b) to ensure not to impersonate another personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses while providing her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for a specified purpose;
(c) to ensure not to suppress any material information while providing her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
(d) to ensure not to register a false or frivolous grievance or complaint with a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18; and
(e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.
Chapter IV

Special Provisions

2 sections
S. 16 Processing of personal data outside India
Open section
16.(1) The Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, restrict the transfer of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... to such country or territory outside India as may be so notified
(2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data outside India in relation to any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data or Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or class thereof.
S. 17 Exemptions
Open section
17. (1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where-
(a) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is necessary for enforcing any legal right or claim;
(b) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is necessary for the performance of such function;
(c) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;
(d) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals not within the territory of India is processed pursuant to any contract entered into with any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses outside the territory of India by any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses based in India;
(e) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force; and
(f) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is for the purpose of ascertaining the financial information and assets and liabilities of any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the provisions regarding disclosure of information or dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means in any other law for the time being in force.
Explanation.-For the purposes of this clause, the expressions "default" and "financial institution" shall have the meanings respectively assigned to them in sub-sections (12) and (14) of section 3 of the Insolvency and Bankruptcy Code, 2016.
Illustration
X, an individual, takes a loan from Y, a bank. X defaults in paying her monthly loan repayment instalment on the date on which it falls due. Y may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X for ascertaining her financial information and assets and liabilities.
(2) The provisions of this Act shall not apply in respect of the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal data-
(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by the Central Government of any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that such instrumentality may furnish to it; and
(b) necessary for research, archiving or statistical purposes if the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is not to be used to take any decision specific to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is carried on in accordance with such standards as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(3) The Central Government may, having regard to the volume and nature of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed, notify certain DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries or class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries, including startups, as DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply.
Explanation.-For the purposes of this sub-section, the term "startup" means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to startups are allocated in the Central Government.
(4) In respect of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is for a purpose that does not include making of a decision that affects the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, sub-section (2) of section 12 shall not apply.
(5) The Central Government may, before expiry of five years from the date of commencement of this Act, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, declare that any provision of this Act shall not apply to such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries for such period as may be specified in the notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly.
Chapter V

Data Protection Board of India

9 sections
S. 18 Establishment of Board
Open section
18.(1) With effect from such date as the Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, appoint, there shall be established, for the purposes of this Act, a BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 to be called the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of India.
(2) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.
(3) The headquarters of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall be at such place as the Central Government may notify.
S. 19 Composition and qualifications for appointment of Chairperson and Members
Open section
19. (1) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall consist of a ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and such number of other Members as the Central Government may notify.
(2) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members shall be appointed by the Central Government in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(3) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members shall be a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses of ability, integrity and standing who possesses special knowledge or practical experience in the fields of dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, or in any other field which in the opinion of the Central Government may be useful to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, and at least one among them shall be an expert in the field of law.
S. 20 Salary, allowances payable to and term of office
Open section
20. (1) The salary, allowances and other terms and conditions of service of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members shall be such as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, and shall not be varied to their disadvantage after their appointment.
(2) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members shall hold office for a term of two years and shall be eligible for re-appointment.
S. 21 Disqualifications for appointment and continuation as Chairperson and Members of Board
Open section
21. (1) A personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses shall be disqualified for being appointed and continued as the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or a MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson, if she-
(a) has been adjudged as an insolvent;
(b) has been convicted of an offence, which in the opinion of the Central Government, involves moral turpitude;
(c) has become physically or mentally incapable of acting as a MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson
(d) has acquired such financial or other interest, as is likely to affect prejudicially her functions as a MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson; or
(e) has so abused her position as to render her continuance in office prejudicial to the public interest.
(2) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson shall not be removed from her office by the Central Government unless sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has been given an opportunity of being heard in the matter.
S. 22 Resignation by Members and filling of vacancy
Open section
22. (1) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or any other MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson may give notice in writing to the Central Government of resigning from her office, and such resignation shall be effective from the date on which the Central Government permits her to relinquish office, or upon expiry of a period of three months from the date of receipt of such notice, or upon a duly appointed successor entering upon her office, or upon the expiry of the term of her office, whichever is earliest.
(2) A vacancy caused by the resignation or removal or death of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or any other MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson, or otherwise, shall be filled by fresh appointment in accordance with the provisions of this Act.
(3) The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and any other MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson shall not, for a period of one year from the date on which they cease to hold such office, except with the previous approval of the Central Government, accept any employment, and shall also disclose to the Central Government any subsequent acceptance of employment with any Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data against whom proceedings were initiated by or before such ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or other MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson.
S. 23 Proceedings of Board
Open section
23. (1) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall observe such procedure in regard to the holding of and transaction of business at its meetings, including by digital means, and authenticate its orders, directions and instruments in such manner as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(2) No act or proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall be invalid merely by reason of-
(a) any vacancy in or any defect in the constitution of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18;
(b) any defect in the appointment of a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses acting as the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board or other MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18; or
(c) any irregularity in the procedure of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, which does not affect the merits of the case.
(3) When the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board is unable to discharge her functions owing to absence, illness or any other cause, the senior-most MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson shall discharge the functions of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board until the date on which the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board resumes her duties.
S. 24 Officers and employees of Board
Open section
24. The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, with previous approval of the Central Government, appoint such officers and employees as it may deem necessary for the efficient discharge of its functions under the provisions of this Act, on such terms and conditions of appointment and service as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
S. 25 Members and officers to be public servants
Open section
25. The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board, Members, officers and employees of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall be deemed, when acting or purporting to act in pursuance of provisions of this Act, to be public servants within the meaning of section 21 of the Indian Penal Code.
S. 26 Powers of Chairperson
Open section
26. The ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board shall exercise the following powers, namely:-
(a) general superintendence and giving direction in respect of all administrative matters of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18;
(b) authorise any officer of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 to scrutinise any intimation, complaint, reference or correspondence addressed to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18; and
(c) authorise performance of any of the functions of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and conduct any of its proceedings, by an individual MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson or groups of Members and to allocate proceedings among them.
Chapter VI

Powers, Functions and Procedure of Board

2 sections
S. 27 Powers and functions of Board
Open section
27.(1) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall exercise and perform the following powers and functions, namely:-
(a) on receipt of an intimation of personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data, and to inquire into such personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data and impose penalty as provided in this Act
(b) on a complaint made by a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in respect of a personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data or a breach in observance by a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data of its obligations in relation to her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
(c) on a complaint made by a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in respect of a breach in observance by a Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform of its obligations in relation to her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, to inquire into such breach and impose penalty as provided in this Act;
(d) on receipt of an intimation of breach of any condition of registration of a Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform, to inquire into such breach and impose penalty as provided in this Act; and
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, for the effective discharge of its functions under the provisions of this Act, after giving the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses, who shall be bound to comply with the same.
(3) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, on a representation made to it by a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.
S. 28 Procedure to be followed by Board
Open section
28. (1) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall function as an independent body and shall, as far as practicable, function as a digital officeDefined in section 2(m): digital office means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(2) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder.
(3) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall determine whether there are sufficient grounds to proceed with an inquiry
(4) In case the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.
(5) In case the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses for ascertaining whether such personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses is complying with or has complied with the provisions of this Act.
(6) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.
(7) For the purposes of discharging its functions under this Act, the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to-
(a) summoning and enforcing the attendance of any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses and examining her on oath;
(b) receiving evidence of affidavit requiring the discovery and production of documents;
(c) inspecting any dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means, book, document, register, books of account or any other document; and
(d) such other matters as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(8) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses.
(9) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.
(10) During the course of the inquiry, if the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses concerned an opportunity of being heard.
(11) On completion of the inquiry and after giving the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses concerned an opportunity of being heard, the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.
(12) At any stage after receipt of a complaint, if the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.
Chapter VII

Appeal and Alternate Dispute Resolution

4 sections
S. 29 Appeal to Appellate Tribunal
Open section
29.(1) Any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses aggrieved by an order or direction made by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under this Act may prefer an appeal before the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997.
(2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(3) The Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period.
(4) On receipt of an appeal under sub-section (1), the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against.
(5) The Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 shall send a copy of every order made by it to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and to the parties to the appeal.
(6) The appeal filed before the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it.
(7) Where any appeal under sub-section (6) could not be disposed of within the period of six months, the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 shall record its reasons in writing for not disposing of the appeal within that period.
(8) Without prejudice to the provisions of section 14A and section 16 of the Telecom Regulatory Authority of India Act, 1997, the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 shall deal with an appeal under this section in accordance with such procedure as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(9) Where an appeal is filed against the orders of the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under this Act, the provisions of section 18 of the Telecom Regulatory Authority of India Act, 1997 shall apply.
(10) In respect of appeals filed under the provisions of this Act, the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 shall, as far as practicable, function as a digital officeDefined in section 2(m): digital office means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode, with the receipt of appeal, hearing and pronouncement of decisions in respect of the same being digital by design.
S. 30 Orders passed by Appellate Tribunal to be executable as decree
Open section
30. (1) An order passed by the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under this Act shall be executable by it as a decree of civil court, and for this purpose, the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 shall have all the powers of a civil court.
(2) Notwithstanding anything contained in sub-section (1), the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 may transmit any order made by it to a civil court having local jurisdiction and such civil court shall execute the order as if it were a decree made by that court.
S. 31 Alternate dispute resolution
Open section
31. If the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 is of the opinion that any complaint may be resolved by mediation, it may direct the parties concerned to attempt resolution of the dispute through such mediation by such mediator as the parties may mutually agree upon, or as provided for under any law for the time being in force in India.
S. 32 Voluntary undertaking
Open section
32. (1) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses at any stage of a proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act under section 28.
(2) The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, or refrain from taking such action, and or publicising such undertaking.
(3) The BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, after accepting the voluntary undertaking and with the consent of the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who gave the voluntary undertaking vary the terms included in the voluntary undertaking.
(4) The acceptance of the voluntary undertaking by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).
(5) Where a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses fails to adhere to any term of the voluntary undertaking accepted by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, such breach shall be deemed to be breach of the provisions of this Act and the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 may, after giving such personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses an opportunity of being heard, proceed in accordance with the provisions of section 33.
Chapter VIII

Penalties and Adjudication

2 sections
S. 33 Penalties
Open section
33.(1) If the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses is significant, it may, after giving the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses an opportunity of being heard, impose such monetary penalty specified in the Schedule.
(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 shall have regard to the following matters, namely:-
(a) the nature, gravity and duration of the breach;
(b) the type and nature of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data affected by the breach;
(c) repetitive nature of the breach;
(d) whether the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses, as a result of the breach, has realised a gainDefined in section 2(o): gain means (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration or avoided any lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration;
(e) whether the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;
(f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and
(g) the likely impact of the imposition of the monetary penalty on the personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses.
S. 34 Crediting sums realised by way of penalties
Open section
34. All sums realised by way of penalties imposed by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under this Act, shall be credited to the Consolidated Fund of India.
Chapter IX

Miscellaneous

10 sections
S. 35 Protection of action taken in good faith
Open section
35.No suit, prosecution or other legal proceedings shall lie against the Central Government, the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18, its ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and any MemberDefined in section 2(q): Member means a Member of the Board and includes the Chairperson, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder.
S. 36 Power to call for information
Open section
36. The Central Government may, for the purposes of this Act, require the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 and any Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or intermediary to furnish such information as it may call for.
S. 37 Power of Central Government to issue directions
Open section
37. (1) The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 that-
(a) intimates the imposition of monetary penalty by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 on a Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data in two or more instances; and
(b) advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to carry on any activity relating to offering of goods or services to DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals within the territory of India,
after giving an opportunity of being heard to that Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information.
(2) Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same.
(3) For the purposes of this section, the expressions "computer resource", "information" and "intermediary" shall have the meanings respectively assigned to them in the Information Technology Act, 2000.
S. 38 Consistency with other laws
Open section
38. (1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.
(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.
S. 39 Bar of jurisdiction
Open section
39. No civil court shall have the jurisdiction to entertain any suit or proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act in respect of any matter for which the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act.
S. 40 Power to make rules
Open section
Rules under this section DPDP Rules
40. (1) The Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.
(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:-
(a) the manner in which the notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall inform her, under sub-section (1) of section 5
(b) the manner in which the notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall inform her, under sub-section (2) of section 5;
(c) the manner of accountability and the obligations of Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform under sub-section (8) of section 6;
(d) the manner of registration of Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform and the conditions relating thereto, under sub-section (9) of section 6;
(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data may be processed under clause (b) of section 7;
(f) the form and manner of intimation of personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (6) of section 8;
(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;
(h) the manner of publishing the business contact information of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10 under sub-section (9) of section 8;
(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;
(j) the classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries, the purposes of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years and the conditions relating thereto, under sub-section (4) of section 9;
(k) the other matters comprising the process of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;
(l) the other measures that the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;
(m) the manner in which a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall make a request to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to obtain information and any other information related to the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure..., under sub-section (1) of section 11;
(n) the manner in which a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall make a request to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for erasure of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data under sub-section (3) of section 12;
(o) the period within which the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall respond to any grievances under sub-section (2) of section 13;
(p) the manner of nomination of any other individual by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf under sub-section (1) of section 14;
(q) the standards for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for exemption under clause (b) of sub-section (2) of section 17;
(r) the manner of appointment of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (2) of section 19;
(s) the salary, allowances and other terms and conditions of services of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (1) of section 20;
(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;
(u) the terms and conditions of appointment and service of officers and employees of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under section 24;
(v) the techno-legal measures to be adopted by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (1) of section 28;
(w) the other matters under clause (d) of sub-section (7) of section 28;
(x) the form, manner and fee for filing an appeal under sub-section (2) of section 29;
(y) the procedure for dealing an appeal under sub-section (8) of section 29;
(z) any other matter which is to be or may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act or in respect of which provision is to be, or may be, made by rules.
S. 41 Laying of rules and certain notification
Open section
41. Every rule made and every notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the rule or notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly or both Houses agree that the rule or notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly should not be made or issued, the rule or notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule or notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly.
S. 42 Power to amend Schedule
Open section
42. (1) The Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, amend the Schedule, subject to the restriction that no such notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.
(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification.
S. 43 Power to remove difficulties
Open section
43. (1) If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty.
(2) No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act.
(3) Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament.
S. 44 Amendments to certain Acts
Open section
44. (1) In section 14 of the Telecom Regulatory Authority of India Act, 1997, in clause (c), for sub-clauses (i) and (ii), the following sub-clauses shall be substituted, namely:-
"(i) the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under the Information Technology Act, 2000;
(ii) the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under the Airports Economic Regulatory Authority of India Act, 2008; and
(iii) the Appellate TribunalDefined in section 2(a): Appellate Tribunal means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 under the Digital Personal DataDefined in section 2(n): digital personal data means personal data in digital form Protection Act, 2023.".
(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:-
(a) section 43A shall be omitted;
(b) in section 81, in the proviso, after the words and figures "the Patents Act, 1970", the words and figures "or the Digital Personal DataDefined in section 2(n): digital personal data means personal data in digital form Protection Act, 2023" shall be inserted; and
(c) in section 87, in sub-section (2), clause (ob) shall be omitted.
(3) In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:-
"(j) information which relates to personal information;"
Chapter Schedule

The Schedule

1 sections
Schedule The Schedule
Open section
THE SCHEDULE [See section 33(1)]
Sl. No.
Breach of provisions of this Act or rules made thereunder
Penalty
1
Breach in observing the obligation of Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to take reasonable security safeguards to prevent personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data under sub-section (5) of section 8.
May extend to two hundred and fifty crore rupees.
2
Breach in observing the obligation to give the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 or affected Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf notice of a personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data under sub-section (6) of section 8.
May extend to two hundred crore rupees.
3
Breach in observance of additional obligations in relation to children under section 9.
May extend to two hundred crore rupees.
4
Breach in observance of additional obligations of Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... under section 10.
May extend to one hundred and fifty crore rupees.
5
Breach in observance of the duties under section 15.
May extend to ten thousand rupees.
6
Breach of any term of voluntary undertaking accepted by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under section 32.
Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted.
7
Breach of any other provision of this Act or the rules made thereunder.
May extend to fifty crore rupees.

Rules made under this Act

— DPDP Rules G.S.R. 846(E)