Understanding the Digital Personal Data Protection Act (DPDPA): A Data Protection Perspective

Apurv Garg

January 22, 2025

Understanding the Digital Personal Data Protection Act (DPDPA): A Data Protection Perspective

DPDPA: A Deep Dive into India’s Data Protection Revolution

The Digital Personal Data Protection Act (DPDPA) is currently the most discussed topic in India and beyond. With its potential to transform the digital privacy landscape, a closer look reveals two key aspects of the draft:

Data Protection
Consent Management

Among experts we’ve engaged with, there is consensus that the rules around Data Protection are far clearer. This clarity stems from alignment with existing RBI/SEBI Infosec guidelines, providing a solid foundation for compliance.

Key Takeaways on Data Protection

Section 3: Notices to Data Principals

Organizations are required to clearly define the data they collect and its purpose.

Section 6: Security Safeguards

DPDPA mandates foundational security measures like encryption and disaster recovery, along with advanced practices such as access controls and database activity monitoring. These requirements aim to elevate industries to the standards set by RBI/SEBI Infosec norms.

Section 7: Notice of Data Breach

Previously, notifying CERT-IN was the primary responsibility for reporting breaches. Under DPDPA, this obligation now extends to directly notifying affected users. Organizations must:

Identify the specific data impacted.
Communicate breaches promptly.
Ensure rapid response capabilities to mitigate risks.

Section 12: Data Protection Impact Assessment (DPIA)

DPIAs under DPDPA focus on auditing:

Data security practices
Consent management frameworks

Additionally, organizations must monitor and ensure that personal data and related traffic are not transferred outside India. This underscores the need for egress traffic monitoring to prevent unauthorized data flows.

Section 14: Cross-Border Data Transfers

This section reinforces data sovereignty, ensuring that sensitive data stays within Indian borders and is subject to local regulatory oversight.

Section 22(1): Government Access to Data

This provision raises concerns about user privacy as it allows the government to request data from fiduciaries like Facebook and Google. Balancing transparency with privacy remains a critical challenge.

https://cdn.sanity.io/images/7yls9lz6/production/d6e70b60af89bcfe544991f28929620d09635ee9-2160x2160.png

DPDPA: A Catch-Up or a Revolution?

The Third Schedule of the DPDPA highlights key sectors like e-commerce, gaming, and social media for enhanced scrutiny. Despite their rapid innovation, these industries often lag in adopting robust security measures compared to sectors regulated by RBI, SEBI, or IRDAI. This focus also hints at the evolving definition of a Significant Data Fiduciary.

Conclusion

As India’s digital ecosystem continues to grow, the DPDPA isn’t just a compliance framework; it’s a step toward a privacy-first, user-centric digital economy. While Data Protection provisions show promise, further clarity on Consent Management will solidify its impact. Stay tuned as we explore governance and consent rules in upcoming discussions.

How Aurva Simplifies DPDPA Compliance for Organizations

Aurva has been purpose-built for companies in India to comply with local regulations such as DPDPA, RBI/SEBI Infosec, and PCI. Trusted by some of the top companies in India, we’ve collaborated with industry leaders and consulted with experts, including MeitY and DSCI officials, to develop a holistic product tailored to address DPDPA data protection needs.

Our AI agents automate DPDPA compliance, helping organizations streamline processes while ensuring robust data security. With Aurva, you can confidently protect sensitive data, meet compliance requirements, and enhance trust in your digital ecosystem. Our holistic approach helps companies:

Identify and classify sensitive data
Understand the purpose of data collection
Monitor data flows to ensure sensitive data isn’t leaving the country
Database Activity Monitor (DAM) to track sensitive data access
Limit the access of sensitive data by understanding who has access to data vs the actual accessors
Automate ROPA and Impact Assessment using Aurva's AI agents
Data Deletion using Aurva's DSAR