DATA PROTECTION IN THE DIGITAL AGE: A CRITICAL ANALYSIS OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Digital Personal Data Protection Act, 2023 marks India’s first comprehensive law on the processing of digital personal data. Enacted after the Supreme Court recognised the right to privacy as a fundamental right in the Puttaswamy case, the Act seeks to balance individual privacy with the needs of a growing digital economy. It introduces a consent-based framework, defines the roles of Data Principals and Data Fiduciaries, grants limited rights to individuals, and creates the Data Protection Board of India for enforcement. This article critically examines the key provisions of the Act, including consent requirements, fiduciary obligations, cross-border data transfers, and wide government exemptions. The law is a significant step forward, however, it has notable limitations in rights protection and institutional independence. The article compares it briefly with the GDPR and suggests reforms to strengthen privacy safeguards in the digital age.