What is DPDPA

DPDPA, which stands for the Digital Personal Data Protection Act, 2023, is India's groundbreaking law to protect the digital personal data of its citizens. The Act was passed by the Indian Parliament in August 2023, and is an important milestone in building a framework for regulating the use of personal information and how organizations handle it in an increasingly digital Indian economy. DPDPA aims to help individuals exert more control over their data and make it clear which organizational party is responsible for the collection, processing, and storage of their data when it is shared in an online situation.

DPDPA essentially provides a framework for India, in much the same way as GDPR or HIPAA provide frameworks in other parts of the world. The law addresses the inherent realities in a nation that is rapidly digitizing, where large amounts of personal data are being created and exchanged on a daily basis. The law's main goal is to create a safe and secure digital environment for all concerned.

Key Principles and Rights of Individuals Under DPDPA

DPDPA is premised on a few key principles (for anyone using or handling data - called 'Data Fiduciaries' and 'Data Processors') and provides rights to individuals (called 'Data Principals') in relation to their digital personal data:

Key Principles (for organizations):

• Lawfulness of Processing: Personal data shall be processed lawfully, fairly, and in a transparent manner, only for a specific, clear, and lawful purpose.

• Purpose Limitation: Organizations should only use the data for the purpose it was collected for.

• Data Minimization: Collect only that personal data which is necessary for the identified purpose.

• Accuracy: The organization must make sure it is maintaining accurate and up-to-date personal data.

• Storage Limitation: The organization must not retain personal data for longer than necessary for the specified purpose. [Completed the sentence based on common data protection principles and similar context in previous glossaries.]

• Appropriate Security Controls: Entities must establish appropriate security controls to mitigate a personal data breach.

• Accountability: Data Fiduciaries are accountable for adhering to the terms of the Act, and they must be able to demonstrate they complied with DPDPA.

Individual Rights (for 'Data Principal'):

• Right to Know: Individuals have the right to know information about their personal data and how this data is being processed.

• Right to Correction and Deletion: Individuals can ask for their data to be corrected if it is inaccurate, and in some cases, even have their data deleted upon request.

• Right to Redressal: Individuals may seek redressal for their complaints about personal data.

• Right to Nominate: Individuals may nominate another individual to exercise their rights upon death or incapacity.

Why Compliance with the DPDPA is Important for companies in India

The DPDPA is critical legislation for any business with a global footprint that will engage with Indian consumers because the DPDPA has broad territorial applicability. Not only does it apply to entities located within India, but it also applies to entities located outside India if they process the digital personal data of 'Data Principals' located within India.

Here is why proper DPDPA compliance is even more important for organizations that operate today:

• Protects Individual Privacy: DPDPA primarily relies on the notion of giving Indian citizens more control and agency over how their personal digital data is used and shared, which ultimately leads to trust in the digital ecosystem.

• Mandates Strong Data Security: The Act explicitly mandates that Data Fiduciaries must "implement reasonable security safeguards" to protect personal data from breaches. This means that data fiduciaries are required to adopt strong IT controls such as strong Identity and Access Management (IAM), Privileged Access Management (PAM), encryption, audit logging, and periodic security audits or security assessments that encompass the specific requirement to protect sensitive information.

• Broad Applicability: DPDPA is broad and applies to numerous persons whether as governmental agencies, corporations or even individuals (in certain contexts). Its extraterritorial applicability means all legitimate entities regardless of where they processed data of people from India must comply.

• Requires Consent and Transparency: The Act emphasizes the need to obtain clear, understandable, and informed consent from individuals before processing their data, along with the need to provide transparent information on what processing is being done with their data.

• Enforces Accountability: Data Fiduciaries are accountable for their processing activities and must show proof of compliance, fostering an ethical culture of responsibility in their handling of data.

• Avoids Heavy Penalties: Potentially, a violation of DPDPA risks heavy financial penalties which could result in a loss of potentially up to ₹250 Crores (~30 million USD) in fines for a serious breach. In addition, there is the further reputational damage of violating the law.

• Drives Better Data Governance: To demonstrate compliance with DPDPA, organizations will need to know what digital personal data they own, where it is stored, what people it is shared with, where the data is processed, and the means for its eventual deletion. This triggers better data governance practices like no one has seen before.

• Fosters a Trusted Digital Economy: The intention of the DPDPA is to provide clear rules and protections so all of India and not just its marketplaces can benefit from a safer, more dependable digital economy, and ultimately support digital innovation for the economy while upholding individual rights.

ReShield offers an identity security platform that is directly correlated with the Digital Personal Data Protection Act (DPDPA) principles and requirements. Its unified approach for Identity and Access Management (IAM), Privileged Access Management (PAM), Identity Governance and Administration (IGA), and Identity Security Posture Management (ISPM) capabilities allows organizations to meet DPDPA requirements. ReShield affords organizations strong security controls like Least Privilege Access (LPA); identity lifecycle management for humans and machines; enforced Separation of Duties (SoD); strong audit trails; and continuous absolute visibility over all logical digital personal data access. Overall, ReShield removes the frictions in complying with the DPDPA and strongly protects individual privacy and mitigates compliance risks.