Legal Guide Part 13 - DPDP Act 2023 & India's Data Protection Regime

- Paragraph 1 - the statute: The Digital Personal Data Protection Act 2023 (DPDP Act) was enacted on 11 August 2023, after a 6-year journey that began with the Srikrishna Committee Report (July 2018) → the Personal Data Protection Bill 2019 → the withdrawn Personal Data Protection Bill 2022 → the Digital Personal Data Protection Bill 2023 (introduced 3 August 2023, passed by both houses, and enacted 11 August 2023). The DPDP Act is India's first horizontal personal-data protection statute - it applies to the processing of digital personal data within India, and to processing outside India that effects data principals in India (s.3). It is anchored on three constitutional bases - the Puttaswamy v. Union of India (2017) 10 SCC 1 right to privacy, the K.S. Puttaswamy (Aadhaar) re-affirmation, and the EU GDPR comparability (the DPDP Act borrows heavily from the GDPR - data principal rights, lawful basis, data fiduciary / data processor split, breach notification, cross-border transfer, DPB). The Act is being brought into force in tranches - sections 1-3, 8-10, 12, 13(a) and (b), 14, 18, 19, 21-25, 29, 30, 32, 36, 37, 40-44, 50-52, 55-57, 60, 61 were notified on 14 January 2025; the remainder (including the substantive processing rules and the Data Protection Board) is yet to be notified as of the date of this dossier.