Governing Data in Corporations; A Critical Analysis of DPDP Act 2023 and its Compliance Lacunas

The Digital Personal Data Protection Act, 2023 (DPDP) is a recently enforced legislature with the purpose to ensure protection of personal data in the digital ecosystem while ensuring fair data processing by the State and private entities to ensure the fundamental right of privacy as declared by the 9-judge bench in the landmark judgement of K.S Puttaswamy v. Union of India and to prevent any kind of misuse or exploitation of personal data. For enabling such accountability and protection of data at digital platforms DPDP Act provides procedures which govern the collection, storage, sharing of such data in a lawful manner. This also imposes a legal duty on entities like corporate and government bodies in regard to procession of data and a fiduciary responsibility that if breached can lead to penalties as per the provisions of the act. Though the purpose of the act is entirely the protection of digital personal data and ensure accountability of organizations in case of such breach, still many lacunas persist within the procedural aspect of this act that can lead to its incompliance and further nullifying the purpose of the act. This blog focuses on such gaps that can appear in the application of this law which need to be filled for the better enforcement of this act.