Data Protection Law: Focus on accountability & consent, but offline data must be treated at par

financialexpress.com:

In an era marked by increasing digitalization and data-driven technologies, India has taken a significant step towards safeguarding its citizens’ digital privacy. The much-awaited Digital Personal Data Protection (DPDP) Act, put together by MEITY after extensive consultations with the public and industry during the draft stages, signifies a crucial development in protecting personal data and upholding individuals’ rights in the digital age.

At its heart, this groundbreaking legislation aims to establish a higher level of accountability and responsibility for businesses operating within India and involved in the collection, storage, and processing of citizens’ data, via a robust consent-based data sharing mechanism. The Act takes an approach similar to other international data protection laws such as the EU’s General Data Protection Regulation (GDPR) and extends its coverage to all entities who process personal data regardless of size or type of the entity. This piece focuses on what new data rights are assured to the consumer and what support the industry requires in this transition phase to implementation of the DPDP.

The DPDP Act enshrines three key rights for individuals. In doing so, it gives individuals who share their personal data, referred to as the “data principals”, a great deal of control over how they share their personal data and how that shared data is used.

Also Read: What are the top benefits of long-term investing? Find out

For starters, explicit consent becomes the basis of collection and use of all digital personal data. This means any personal data can be included and processed by any entity, referred to as “data fiduciary”, only with explicit and informed consent of the individual. This means that