Revision summary
The DPDP Act, 2023, follows the Puttaswamy privacy judgment and replaces a thin IT Act patch. It regulates digital personal data: Data Principals, Data Fiduciaries, consent and some legitimate uses. Rights include access, correction, erasure, nomination and grievance redress; children get extra protection. A Data Protection Board can penalise; Significant Data Fiduciaries carry heavier duties. The Union may exempt State agencies on security and related grounds, which is the main rights tension.
Model answer
Copper italics in this answer — like this — are the key facts. Each one is unpacked in the Facts & figures rail.
Introduction
India’s data economy grew faster than its privacy statute. After Justice K.S. Puttaswamy v. Union of India (2017) held privacy to be a fundamental right, a long draft trail — Justice Srikrishna, several bills, and the withdrawal of the 2019 Bill — ended in the Digital Personal Data Protection Act, 2023. The context is Aadhaar-scale databases, platform power and a Court that asked for a law. The Act is that law: shorter than the 2019 draft, and still a first national code for digital personal data.
Body
Context
Puttaswamy required a proportionate, legal and legitimate basis to touch personal data. India already had IT Act section 43A and SPDI rules: a thin, harm-after-the-fact patch. Europe’s GDPR raised the bar for any firm that wanted EU custom. Domestic politics wanted ease of doing digital business as well as a privacy promise. The 2023 Act therefore sits between a rights judgment and a growth agenda: consent as the default, a Board instead of a heavy multi-regulator, and wide Union exemptions. That last piece is why rights groups still argue the Act is incomplete. It is nonetheless the salient legal fact students must know.
- Peg: Puttaswamy (2017) is the constitutional parent; the 2023 Act is the statutory child.
- Peg: The older 43A/SPDI regime did not create a Data Protection Board or a clear set of principal rights.
Salient features
The Act covers digital personal data processed in India, and some processing abroad if it offers goods or services in India. A Data Principal is the individual. A Data Fiduciary decides purpose and means. Consent must be free, specific, informed, unconditional and unambiguous, with a notice. Certain legitimate uses (including some State uses specified in the Act) allow processing without that consent track. Principals get rights to access, correction, erasure and grievance redress, and a right to nominate in case of death or incapacity. Children’s data has extra care, including a bar on tracking or targeted ads in the terms the Act sets. Significant Data Fiduciaries may be designated for extra obligations (data protection officer, audits, impact assessment). A Data Protection Board of India is to inquire and impose financial penalties. The Union may exempt agencies of the State in the interests of sovereignty, security, public order and similar grounds listed in the Act. Cross-border transfer is allowed except to countries the Union restricts by notification. The design is therefore principle-plus-Board, not a GDPR photocopy. The live tension is security and administration versus the Puttaswamy tests of necessity and proportionality — technology with governance, not technology as an exemption.
- Peg: Consent, legitimate uses, Significant Data Fiduciary duties, and the Data Protection Board are the working spine.
- Peg: Section-style State exemptions are the rights critique: a privacy Act that the State can step around still needs Puttaswamy in court.
Flow diagram
Conclusion
- DPDP 2023 answers Puttaswamy with a digital-personal-data code: principals, fiduciaries, consent, a Board and penalties. It also leaves broad State exemptions. The Act is a start. Whether it protects privacy will depend on rules, the Board’s spine, and how those exemptions are used.
Quick related
Students also ask
-
Discuss the merits and demerits of the four Labour Codes' in the context of labor market reforms in India. What has been the progress so far in this regard?
Next question on this syllabus topic (2024 · Q11). View answer →
-
Does DPDP copy the GDPR?
No. It is shorter, consent-heavy, Board-centric, and more generous to State exemptions than the EU model.
-
Does the Act cover paper files?
Its core is digital personal data, including data that is digitised. A purely analogue record is not the main target.
Same topic · past papers
UPSC has asked this before
These previous-year questions sit on the same topic. Open one to practise the earlier ask.
-
2018 · Q19 · GS III · 15 marks
Data security has assumed significant importance in the digitized world due to rising cyber-crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space? (250 Words, 15 Marks). -
2026 · Q15 · GS III · 15 marks
Mention salient features of 'Mission Drishti'. Discuss the imaging techniques used in the satellite launched on 3rd May 2026. Why is it being considered world's first satellite of its kind? -
2026 · Q17 · GS III · 15 marks
What are the challenges to solid waste management in India? Discuss the governmental policy framework on solid waste management. Discuss the success/failure cases of Delhi and Indore cities highlighting the salient features of their solid waste management initiatives. -
2025 · Q16 · GS III · 15 marks
India aims to become a semiconductor manufacturing hub. What are the challenges faced by the semiconductor industry in India? Mention the salient features of the India Semiconductor Mission. -
2016 · Q13 · GS III · 12 marks
Why is nanotechnology one of the key technologies of the 21st century? Describe the salient features of Indian Government's Mission on Nanoscience and Technology and the scope of its application in the development process of the country.
More from this topic
Q17 · UPSC Mains 2026 · GS III · 15 marks · Solution
What are the challenges to solid waste management in India? Discuss the governmental policy framework on solid waste management. Discuss the success/failure cases of Delhi and Indore cities highlighting the salient features of their solid waste management initiatives.
Indian Economy
• Rapid urbanization has made solid waste management a critical environmental and public health crisis in India. • Key challenges include lack of source segregation, inadequate processing infrastructure, reliance on unprotected informal workers, and financially weak urban local bodies. • The policy framework relies on the SWM Rules 2016, Swachh Bharat Mission (Urban), and Plastic Waste Management Rules 2016. • Indore succeeded through 100% source segregation, zero dump-site remediation, and strict enforcement with digital monitoring. • Delhi failed due to overloaded legacy landfills (Ghazipur, Bhalswa), lack of decentralization, and fragmented municipal governance. • A successful transition requires moving to a circular economy focused on source segregation, decentralized processing, and polluter accountability.
Q16 · UPSC Mains 2026 · GS III · 15 marks · Solution
What is Agentic Artificial Intelligence (AI)? Explain its working. Describe its applications with suitable examples. Discuss the advantages, risks and challenges associated with agentic AI systems.
Indian Economy
Agentic Artificial Intelligence represents an advanced paradigm where AI systems operate with autonomy, setting goals and executing complex workflows without constant human prompts. Unlike traditional generative AI that merely responds to queries, agentic AI uses perception, planning, memory, and tool-use to achieve multi-step objectives. Its applications span across autonomous software engineering, supply chain optimization, and automated financial trading. While offering massive productivity gains and dynamic problem-solving, these systems pose significant risks including lack of transparency, alignment failures, security vulnerabilities, and ethical dilemmas. Governance frameworks and robust guardrails are essential to harness their potential safely.
Q15 · UPSC Mains 2026 · GS III · 15 marks · Solution
Mention salient features of 'Mission Drishti'. Discuss the imaging techniques used in the satellite launched on 3rd May 2026. Why is it being considered world's first satellite of its kind?
Indian Economy
Mission Drishti represents a major leap in India's space-based Earth observation capabilities, launched on 3rd May 2026. The mission employs advanced multi-spectral and hyperspectral imaging techniques to capture high-resolution data across various atmospheric and terrestrial layers. It is hailed as a global first due to its unique integration of real-time onboard edge computing with quantum encryption for secure data transmission. The satellite significantly enhances resource management, disaster response, and strategic surveillance. It aligns with India's policy of leveraging space technology for sustainable development and national security.