India Enacts A Comprehensive Data Privacy Law: The Digital Personal Data Protection Act

The Indian Central Government (Central Government) enacted a broad and significant privacy law, the Digital Personal Data Protection Act (the DPDP), on August 11. The DPDP, when effective (as per dates to be notified by the Central Government), will govern the personal data processing activities of a broad range of organizations in the Indian market (the fifth largest global economy). The DPDP provides a comprehensive data protection framework for India but will be supplemented by rules to be issued by the Central Government in due course (on 25 prescribed subjects). The Data Protection Board of India (Board) also will be established as the adjudicatory body with the power to determine non-compliance with the DPDP and impose penalties. Only when the rules are issued, and the Board is established and starts to interpret the various provisions of the DPDP will we be able to understand the full scope of this new law. In the interim period, businesses should begin