Breaking Down India's Digital Personal Data Protection Act, 2023

In August, India passed its long-awaited Digital Personal Data Protection Act, 2023 ("the Act"). Initially introduced in 2019, the draft bill went through several iterations before being approved by India's Union Cabinet earlier this year. Although the Act shares many similarities to other privacy legislation, such as the EU's GDPR and the United Kingdom's UK GDPR, there are a few notable distinctions. While no official effective date for the law has been announced, companies should start familiarizing themselves with this new privacy law and its requirements. Here is a breakdown of what you should know.

Applicability

Unlike some of the U.S. data protection laws, which implement processing or revenue thresholds for applicability (i.e., the CCPA's $25 million gross annual revenue threshold or the VCDPA's 100,000 VA residents processing threshold), the Act is widely applicable to entities doing business in India. The Act applies to all persons and entities that: