Revision summary
The DPDP Act, 2023, follows the Puttaswamy privacy judgment and replaces a thin IT Act patch. It regulates digital personal data: Data Principals, Data Fiduciaries, consent and some legitimate uses. Rights include access, correction, erasure, nomination and grievance redress; children get extra protection. A Data Protection Board can penalise; Significant Data Fiduciaries carry heavier duties. The Union may exempt State agencies on security and related grounds, which is the main rights tension.
Model answer
Introduction
India’s data economy grew faster than its privacy statute. After Justice K.S. Puttaswamy v. Union of India (2017) held privacy to be a fundamental right, a long draft trail — Justice Srikrishna, several bills, and the withdrawal of the 2019 Bill — ended in the Digital Personal Data Protection Act, 2023. The context is Aadhaar-scale databases, platform power and a Court that asked for a law. The Act is that law: shorter than the 2019 draft, and still a first national code for digital personal data.
Body
Context
Puttaswamy required a proportionate, legal and legitimate basis to touch personal data. India already had IT Act section 43A and SPDI rules: a thin, harm-after-the-fact patch. Europe’s GDPR raised the bar for any firm that wanted EU custom. Domestic politics wanted ease of doing digital business as well as a privacy promise. The 2023 Act therefore sits between a rights judgment and a growth agenda: consent as the default, a Board instead of a heavy multi-regulator, and wide Union exemptions. That last piece is why rights groups still argue the Act is incomplete. It is nonetheless the salient legal fact students must know.
- Peg: Puttaswamy (2017) is the constitutional parent; the 2023 Act is the statutory child.
- Peg: The older 43A/SPDI regime did not create a Data Protection Board or a clear set of principal rights.
Salient features
The Act covers digital personal data processed in India, and some processing abroad if it offers goods or services in India. A Data Principal is the individual. A Data Fiduciary decides purpose and means. Consent must be free, specific, informed, unconditional and unambiguous, with a notice. Certain legitimate uses (including some State uses specified in the Act) allow processing without that consent track. Principals get rights to access, correction, erasure and grievance redress, and a right to nominate in case of death or incapacity. Children’s data has extra care, including a bar on tracking or targeted ads in the terms the Act sets. Significant Data Fiduciaries may be designated for extra obligations (data protection officer, audits, impact assessment). A Data Protection Board of India is to inquire and impose financial penalties. The Union may exempt agencies of the State in the interests of sovereignty, security, public order and similar grounds listed in the Act. Cross-border transfer is allowed except to countries the Union restricts by notification. The design is therefore principle-plus-Board, not a GDPR photocopy. The live tension is security and administration versus the Puttaswamy tests of necessity and proportionality — technology with governance, not technology as an exemption.
- Peg: Consent, legitimate uses, Significant Data Fiduciary duties, and the Data Protection Board are the working spine.
- Peg: Section-style State exemptions are the rights critique: a privacy Act that the State can step around still needs Puttaswamy in court.
Flow diagram
flowchart TD P[Puttaswamy 2017] --> A[DPDP Act 2023] A --> DP[Data Principal rights] A --> DF[Fiduciary duties] A --> B[Data Protection Board] X[State exemptions] --> A
Conclusion
- DPDP 2023 answers Puttaswamy with a digital-personal-data code: principals, fiduciaries, consent, a Board and penalties. It also leaves broad State exemptions. The Act is a start. Whether it protects privacy will depend on rules, the Board’s spine, and how those exemptions are used.
Quick related
Students also ask
-
Discuss the merits and demerits of the four Labour Codes' in the context of labor market reforms in India. What has been the progress so far in this regard?
Next question on this syllabus topic (2024 · Q11). View answer →
-
Does DPDP copy the GDPR?
No. It is shorter, consent-heavy, Board-centric, and more generous to State exemptions than the EU model.
-
Does the Act cover paper files?
Its core is digital personal data, including data that is digitised. A purely analogue record is not the main target.
PYQ trend
When UPSC asked this
Related PYQs from other years, newest first. Open a question to read it.
-
2024 · Q2 · GS III · 10 marks
What are the causes of persistent high food inflation in India? Comment on the effectiveness of the monetary policy of RBI to control this type of inflation. -
2024 · Q4 · GS III · 10 marks
Explain the role of millets for ensuring health and nutritional security in India. -
2024 · Q5 · GS III · 10 marks
What is the present world scenario of intellectual property rights with respect to life materials? Although, India is second in the world to file patents, still only a few have been commercialized. Explain the reasons behind this less commercialization. -
2024 · Q11 · GS III · 15 marks
Discuss the merits and demerits of the four Labour Codes' in the context of labor market reforms in India. What has been the progress so far in this regard? -
2024 · Q12 · GS III · 15 marks
What is the need for expanding the regional air connectivity in India? In this context, discuss the government's UDAN Scheme and its achievements. -
2024 · Q15 · GS III · 15 marks
The world is facing an acute shortage of clean and safe alternative freshwater. What are the technologies which can solve this crisis? Briefly discuss any three such technologies, citing their key merits and demerits. -
2024 · Q16 · GS III · 15 marks
what are asteroids? How real is the threat of them causing extinction of life? What strategies have been developed to prevent such a catastrophe? -
2024 · Q20 · GS III · 15 marks
Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the security implications of social media? Also suggest any other remedies to address the problem.
More from this topic
Q20 · UPSC Mains 2025 · GS III · 15 marks
Why is maritime security vital to protect India's sea trade? Discuss maritime and coastal security challenges and the way forward.
Indian Economy
About nine-tenths of India’s trade volume and most oil still move by sea, so a chokepoint shock is an economic shock. Coastal creeks, 26/11-style gaps, illegal fishing, piracy and a denser Chinese naval presence are the main challenges. Red Sea attacks in 2023–24 showed how quickly freight and insurance can jump. SAGAR, IPOI, IMAC fusion, coastal police and partner patrols are the reply. Ports and shipbuilding make security a growth story, not only a patrol story.
Q16 · UPSC Mains 2025 · GS III · 15 marks
India aims to become a semiconductor manufacturing hub. What are the challenges faced by the semiconductor industry in India? Mention the salient features of the India Semiconductor Mission.
Indian Economy
India designs many chips but still makes few, because fabs need capital, ultra-pure water, chemicals and restricted tools. Geopolitics and long project time add risk. The India Semiconductor Mission (2021) has about ₹76,000 crore for fabs, display, compound semiconductors and packaging. A design-linked incentive targets the talent India already has. Mature nodes and ATMP are the realistic near path; leading-edge logic will follow slowly if at all.
Q12 · UPSC Mains 2025 · GS III · 15 marks
Discuss the rationale of the Production Linked Incentive (PLI) scheme. What are its achievements? In what way can the functioning and outcomes of the scheme be improved?
Indian Economy
PLI is a time-bound payment on extra sales to pull manufacturing scale into India. About fourteen sectors share an outlay near two lakh crore rupees. Mobile assembly and exports are the clearest win; value addition and several heavy sectors lag. Jobs exist mainly in assembly unless design and components deepen. Reform means easier claims, MSME access, export and value-addition metrics, and a sunset.
Toppers' copies
Toppers' copies for this question will be uploaded soon.