Chat on WhatsApp

Digital Personal Data Protection Act2023

Follow your data

India’s data protection law in eight stops. Follow one piece of personal data, try each idea on the model, and open the details when you want the full text.

8 stations · about 5 minutes

An explainer, not legal advice.

01/ 08People

Your data, and who holds it

Personal data is information that points at an identifiable person. Once it is digital, the Act covers it.

  • You are the Data Principal. The individual the data relates to.
  • The Data Fiduciary decides. It chooses why and how your data is processed.
  • A Data Processor works for it. Hiring a vendor does not move the fiduciary’s responsibility.

Who is who?

The Data Principal: the individual to whom the personal data relates.

02/ 08Reason

A reason, and a lawful ground

Holding data is not a reason to use it. Processing needs a named purpose and either your consent or a legitimate use the Act lists.

  • Two grounds. Your consent, or a use the Act itself specifically lists.
  • No relabelling. Calling advertising a “legitimate use” to skip asking is not allowed.
  • The purpose is a boundary. Only what that purpose needs. No quiet reuse.

Pick the route your data takes

You agree to the processing for a stated purpose. The consent route lights.

04/ 08Purposes

One switch is not a choice

Optional purposes like analytics and advertising should be separable from what the service needs, and only what your choice allows should run.

  • Each purpose, its own answer. Accept, reject, or choose purpose by purpose.
  • Declining is valid. A declined purpose is a supported answer, not a failure.
  • The choice must hold. Scripts and vendors run only for the purposes allowed.

Your choices

Declined: advertising. Its stream stays open but stops before its vendor, which stays dark. Declining is a supported answer.

05/ 08Record

Recorded, and reversible

The choice is kept as evidence. Withdrawing must be as easy as consenting, and what relied on the consent has to stop.

  • A record, not a memory. The notice version shown, what you chose, and when.
  • Withdraw at any time. Systems that relied on consent are told and stop, one after another.
  • Not a rewind, not erasure. Earlier lawful processing stays lawful. Withdrawal is not deletion by itself.

Change your mind

The record holds your decision, the notice version you saw and the time.

06/ 08Rights

Your rights. Their duties.

You can ask for access, correction, erasure, grievance redressal and nomination. The fiduciary owes far more than a consent banner.

  • Exercised with the fiduciary. With a path onward to the Data Protection Board.
  • Consent is one duty of many. Security, accuracy, processor contracts, deletion and more.
  • Some carry more. The Government may designate Significant Data Fiduciaries.

See it from either end

Access, correction, erasure, grievance, nomination, and withdrawal of consent, each a line from you to where your data went.

07/ 08Stricter

Where the rules tighten

A child’s data needs a guardian’s verifiable consent. A Consent Manager is a registered role, not a piece of software.

  • Under eighteen. Verifiable consent from a parent or lawful guardian.
  • Not permitted. Tracking, behavioural monitoring and targeted advertising directed at children.
  • Role, not tool. Deploying consent software registers nobody with the Board.

Look closer at

A double wall around the data. A guardian’s consent comes through one prescribed check; tracking and targeted ads are stopped at the wall.

08/ 08System

It was never just a banner

Notice, request, choice, recorded, applied, change or withdraw, updated: a lifecycle inside wider duties, about a person.

  • A workflow, not the whole Act. Security, retention and children’s data sit outside the banner.
  • The duty stays put. With the Data Fiduciary, throughout.
  • Check the source. Rules and notified dates keep moving. Read the official text.

Walk the lifecycle

Notice: the data and the purpose, explained before the question.