After several years of debate, India has passed the Digital Personal Data Protection Act of 2023 (DPDPA), an overhaul of the country’s data protection regime that will require employers operating in India to take stock of current data protection policies and ensure alignment with the new law.
Like the European Union’s General Data Protection Regulation (GDPR), the DPDPA is a comprehensive framework that will require data processers to identify a lawful purpose for processing personal data, with limited exceptions such as in cases where the data is publicly available or the processing is necessary as part of a merger or a restructuring. Similar to the GDPR, it applies to all data processing in India or that is related to the provision of goods and services to individuals in India.
In a positive development for employers, the version of the DPDPA that passed was scaled-back in several respects from earlier drafts of the legislation. For example, unlike the GDPR, the new DPDPA permits cross-border transmission of personal data to most countries without any stipulation as to the strength of data protection regulations in those jurisdictions. The DPDPA also does not create any special provision for “sensitive” personal data, making requirements for the processing of sensitive information such as diversity data subject to the same restrictions as all data processing.
The law establishes the Data Protection Board of India as an enforcement body, which can issue significant monetary penalties for non-compliance.
The law applies universally to employers operating in India and leaves intact sector-specific requirements applicable to companies operating in the insurance, financial services, and banking industries. It is expected to take effect in the coming months and will be supplemented by specific rules that have not yet been published. We will continue to keep you apprised of new international employment developments.
