Data Protection on Paper: Implementation and Challenges of India's Digital Personal Data Protection Act , 2023

Abstract

The Digital Personal Data Protection Act, 2023 (DPDP Act) is the first comprehensive data protection law in India that creates a framework for the processing of digital personal data while attempting to balance individuals' privacy rights and legitimate business interests. However, moving from legislative intent to actual implementation presents enormous challenges that threaten the practical effectiveness of the DPDP Act. This paper critically assesses the implementation challenges associated with the DPDP Act by reviewing its avenues for enforcement, business compliance burden, and structural features. Our analysis surfaces five main issues: the centralised enforcement structure yielding an "enforcement deficit," disproportionate compliance burdens placed upon Micro, Small and Medium Enterprises (MSMEs), multi-layered consent management, resulting in "consent fatigue," regulatory uncertainty in cross-border data transfers, and congruence with existing laws. Through an assessment of academic analyses, industry reports, and comparative jurisprudence, we conclude that while the DPDP Act offers important principles of privacy, the implementation framework requires significant improvements regarding its ability to achieve its stated purpose. We provide specific recommendations regarding these implementation issues by way of decentralised enforcement, tiered compliance obligations, and improved regulatory guidance to facilitate compliance.

Keywords: Data Protection, DPDP Act 2023, Implementation Challenges, Enforcement Deficit, Digital Privacy, India Data Protection Board, Regulatory Compliance