In August this year, India replaced its set of data security
rules with a new Digital Personal Data Protection Act, 2023
("DPDP"). The regulatory framework governing data
protection in India was archaic, with laws primarily outlining
basic data security requirements.
In a rapidly changing digital economy, the DPDP has been
positioned to fill a vital gap in the data protection regime in
India. The DPDP calls for compliance in the collection and
processing of personal data, towards specific lawful purposes. Data
Fiduciaries, who determine 'the purpose and means of processing
of personal data', have been tasked with several obligations
towards protecting individuals' personal data, failing which
would risk steep penalties. The obligations also extend towards the
protection of processing of children's data and the prevention
of behavioural tracking and targeted advertising. The Act also has
extra-territorial application, and allows the Government the power
to restrict
