डिजिटल व्यक्तिगत डेटा संरक्षण अधिनियम, 2023
India's landmark data privacy law — consent framework, data principal rights, data fiduciary obligations, cross-border transfers, and penalties up to ₹250 crore.
Every processing of personal data requires free, specific, informed, unconditional consent. Notice must be in clear plain language with: purpose of processing, rights available, complaint mechanism. Consent can be withdrawn anytime — withdrawal must be as easy as giving consent. Children's data (under 18) requires verifiable parental consent. No tracking, behavioural monitoring, or targeted advertising to children.
Right to information about processing activities. Right to correction of inaccurate data and erasure when data is no longer necessary. Right to nominate another person to exercise rights (in case of death/incapacity). Right to grievance redressal — Data Fiduciary must respond within prescribed time. Right to complain to Data Protection Board if grievance not resolved.
Data Protection Board of India established as adjudicating body. Maximum penalty: ₹250 crore for failure to protect against data breach. ₹200 crore for non-compliance with children's data provisions. ₹150 crore for failure to notify breach. ₹50 crore for Data Principal's failure to comply with duties. Appeals to High Court on questions of law and fact.
This guide is for educational purposes. For advice specific to your situation, consult a qualified advocate.
22+ years of practice before Punjab & Haryana High Court.