The introduction of the Digital Personal Data Protection (DPDP) Rules, 2025, is a significant milestone towards establishing a privacy-compliant society. While change is inevitable, it’s natural to resist it. With the rapid advancement of technologies, new forms of data breaches are emerging, making data protection a paramount responsibility of the state.
The Digital Personal Data Protection (DPDP) Act, 2023, primarily focuses on safeguarding the digital personal data of individuals in India. It establishes guidelines for organizations to collect, process, store, and transfer personal data while ensuring the protection of privacy rights.
The DPDP Act primarily covers “Digital Personal Data,” which encompasses personal data, such as names, contact details (phone numbers, emails), addresses, dates of birth, identification numbers (Aadhaar, PAN, passports, etc.), financial details (bank accounts, UPI IDs), biometric data (fingerprints, iris scans, facial recognition), location data, IP addresses, cookies, and device identifiers (if linked to a person).
The data covered under the DPDP Act can be further classified into two categories:
1. Personal Data: This includes any data about an individual (Data Principal) that can directly or indirectly identify them. Examples include names, contact details, addresses, dates of birth, identification numbers (Aadhaar, PAN, passports, etc.), financial details (bank accounts, UPI IDs), biometric data (fingerprints, iris scans, facial recognition), location data, IP addresses, cookies, and device identifiers (if linked to a person).
2. Digitally Processed Data: This category includes data that has been collected, stored, or processed in digital form, even if it was originally collected offline but later digitized. Sensitive personal data, such as health data (medical records, prescriptions), financial data (bank details, credit/debit card information), genetic data, sexual orientation, caste, and religion (if used for identification), requires higher protection. Children’s personal data and data of individuals with disabilities are also protected.
The adage, “Personal data is the new currency,” emphasizes the importance of safeguarding individual privacy. In the digital age, personal data becomes increasingly valuable, making privacy rights more crucial than ever. Initially, the government adopted a stringent approach by making data protected and accountability of data handler the ultimate rule. However, this provision was not included in the DPDP Act, 2023, due to societal backlash.
Section 16 of the Digital Personal Data Protection Act, 2023, when read in conjunction with Rule 14 of the Draft Rules, 2025, states that the Central Government shall publish a list of restricted countries to which data cannot be transferred. The Central Government shall also specify the requirements that data fiduciaries must follow when data is transferred to foreign countries for certain goods and services by general or special order.
In conclusion, The Digital Personal Data Protection (DPDP) Act, 2023, aims to protect digital personal data in India, including sensitive data like health and financial information. The Act categorizes data into personal and digitally processed data, with the latter requiring higher protection. While data localization was initially proposed, the Act now allows data transfer to foreign countries under specific conditions.
Advocate Ankit Prasad
(Writer is a practicing lawyer at Hon’ble High Court of Delhi)
ankitprasad965@gmail.com
