Parliament Passes Comprehensive Data Protection & Privacy Act

Addressing the digital age's challenges, the new Data Protection Act introduces stringent regulations on data fiduciaries, emphasizing user consent, data localization, and heavy penalties for breaches. The Act balances privacy rights with digital innovation.

In a landmark legislative session, the Indian Parliament has successfully passed the Comprehensive Data Protection and Privacy Act, fundamentally transforming the digital rights of over a billion citizens. This highly anticipated legislation aims to strike a delicate balance between individual privacy rights, established as a fundamental right by the Supreme Court in the Puttaswamy judgement, and the needs of a rapidly innovating digital economy.

At the core of the Act is the concept of explicit and informed user consent. Data fiduciaries—companies that collect and process user data—must now provide clear, multilingual notices explaining exactly what data is being collected and for what purpose. The Act introduces the principle of 'data minimization', ensuring that companies only collect data strictly necessary for their stated services.

A highly debated aspect of the new law is its data localization mandate. Critical personal data must now be stored on servers physically located within India's borders. While this ensures that Indian law enforcement has timely access to data for national security purposes, multinational tech giants have expressed concerns over the increased operational costs and potential fragmentation of the global internet.

Furthermore, the Act establishes the Data Protection Board of India, a powerful regulatory body tasked with overseeing compliance and investigating breaches. The Board is empowered to levy severe financial penalties, which can run into hundreds of crores, against companies that fail to implement adequate security safeguards. For UPSC candidates, this Act represents a vital intersection of polity, governance, and technology, redefining the social contract in the digital age.