Digital Personal Data Protection Act, 2023: India’s Emerging Paradigm for Data Privacy

In the contemporary digital ecosystem, the exponential growth of data-driven technologies, digital identity systems, and online platforms has intensified concerns surrounding data privacy, protection frameworks, and responsible surveillance. India, as one of the world’s largest digital societies, has witnessed unprecedented expansion in digital governance, financial technologies, healthcare digitization, and social media usage, all of which involve large-scale collection, processing, and storage of personal data. Policy challenge. The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a significant milestone in India’s data protection journey, seeking to establish a comprehensive framework governing the processing of digital personal data. The Act introduces key principles such as consent-based data processing, purpose limitation, data minimization, and accountability of data fiduciaries, while also recognizing the rights and duties of data principals. At the same time, it creates institutional mechanisms such as the Data Protection Board of India to oversee compliance and adjudicate disputes. While the DPDP Act represents a progressive step towards aligning India’s data protection regime with global standards, it also raises important questions regarding implementation, enforcement capacity, exemptions granted to the State, and the adequacy of safeguards against excessive surveillance.

This article critically examines India’s evolving data privacy and protection frameworks within the broader cyber security landscape, with particular emphasis on digital identity systems and responsible surveillance. It analyses how large-scale digital identity initiatives and data-intensive governance models, while enhancing efficiency and service delivery, also amplify risks of data breaches, profiling, function creep, and misuse of personal information. The study evaluates whether the DPDP Act, 2023 sufficiently addresses these risks, especially in relation to government access to data, cross-border data transfers, and proportionality in surveillance practices.

Further, the article situates India’s data protection framework in a comparative perspective, drawing insights from international data protection regimes such as the EU’s General Data Protection Regulation (GDPR), to assess the strengths and limitations of the Indian approach. Special attention is paid to the concept of responsible surveillance, examining the constitutional principles of privacy, necessity, and proportionality as articulated by Indian courts, and their practical application in the digital era. The research also highlights challenges faced by enforcement agencies, private entities, and individuals in navigating compliance obligations under the DPDP Act amid rapid technological advancements and increasing cyber security threats.