Digital Personal Data Protection Act, 2023
AI / PRIVACY / CYBER RELEVANCE
Directly applies where AI/ML/GenAI performs processing of digital personal data. The definition of processing expressly includes a “wholly or partly automated operation”.
AI: HighPrivacy: Very HighCybersecurity: High
READ FIRST
- Section 2(b) - “automated”
- Section 2(x) - “processing” includes automated operations
- Sections 4 - 10 - processing / fiduciary duties
- Sections 18 - 26 - Board / enforcement architecture
PURVIEW
Creates the core horizontal statutory framework for processing digital personal data in India. It governs when and on what legal basis personal data may be processed; defines Data Principals, Data Fiduciaries, Data Processors and processing; regulates consent and certain legitimate uses; imposes duties concerning security, breach management, retention and accountability; contains enhanced obligations for Significant Data Fiduciaries; establishes Data Principal rights; and creates the Data Protection Board and penalty structure.
Classification and legal status. Binding primary legislation; phased commencement. Only the provisions brought into force by notification (first, G.S.R. 843(E)) are operative until later dates are notified; large substantive blocks commence later.