# Standards and Regulatory References — India DPDP Act

## Primary Legislation

### Digital Personal Data Protection Act, 2023 (DPDP Act)
- **Act Number**: Act No. 22 of 2023
- **Presidential assent**: 11 August 2023
- **Gazette notification**: 11 August 2023
- **Structure**: 8 chapters, 44 sections, and a Schedule of penalties
- **Implementation status**: Awaiting final DPDP Rules notification (draft rules published for consultation)

### Information Technology Act, 2000 (IT Act)
- **Relevant provisions**: Section 43A (compensation for failure to protect data) — to be replaced by DPDP Act
- **SPDI Rules 2011**: Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — will be superseded by DPDP Act provisions upon full commencement
- **Continuing relevance**: IT Act Sections 65-67 (cybercrime provisions) remain in force

### Draft DPDP Rules (Published for Consultation)
- **Key provisions**:
  - Consent Manager registration process and requirements (minimum INR 2 crore net worth)
  - Data Protection Impact Assessment methodology for SDFs
  - Breach notification form and timeline (72-hour notification proposed)
  - Children's data verification mechanisms
  - Cross-border transfer restricted country list mechanism
  - Board procedures for adjudication

## Sectoral Regulations

### Reserve Bank of India (RBI) Data Localisation
- **RBI Circular on Storage of Payment System Data (April 2018)**
- Requires all payment system data processed by payment system operators to be stored exclusively in India
- Processing may occur abroad but a copy must be stored in India within 24 hours
- Applies alongside DPDP Act Section 16

### Securities and Exchange Board of India (SEBI)
- **SEBI Circular on Cybersecurity and Cyber Resilience Framework (2018, updated 2023)**
- Requires regulated entities to implement data protection measures
- Cloud service providers used by SEBI-regulated entities must store data in India

### Insurance Regulatory and Development Authority of India (IRDAI)
- **IRDAI Information and Cybersecurity Guidelines (2023)**
- Requires insurance companies to implement data protection measures
- Data localisation requirements for policyholder data

### Telecom Regulatory Authority of India (TRAI)
- **Telecom Commercial Communications Customer Preference Regulation (2018)**
- Regulates unsolicited commercial communications
- Interacts with DPDP Act consent requirements for marketing

## Constitutional Framework

### Article 21 — Right to Life and Personal Liberty
- The Supreme Court of India in Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 recognised the right to privacy as a fundamental right under Article 21
- This decision was the constitutional foundation for the DPDP Act

### Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)
- **Citation**: (2017) 10 SCC 1
- **9-judge bench**: Unanimous decision recognising right to privacy as fundamental right
- **Three-part test**: Restriction of privacy must be (1) sanctioned by law, (2) necessary for a legitimate state aim, (3) proportionate
- **Impact**: Directly led to the drafting process resulting in the DPDP Act

## DPDP Act vs GDPR Key Differences

| Feature | DPDP Act | GDPR |
|---------|----------|------|
| Scope of personal data | Digital personal data only (Section 3) | All personal data (digital and physical) |
| Lawful bases | Consent or legitimate uses (Section 6-7) | Six bases under Art. 6 |
| Children's age threshold | 18 years (Section 9) | 16 years (Art. 8, lowerable to 13) |
| Consent Manager concept | Yes — registered intermediary (Section 6(7)) | No direct equivalent |
| Data Principal duties | Yes — duties on individuals (Section 15) | No duties on data subjects |
| Cross-border transfer approach | Blacklist (restricted countries) (Section 16) | Whitelist (adequacy decisions) |
| DPO requirement | SDFs only (Section 10) | Required for certain controllers/processors (Art. 37) |
| Maximum penalty | INR 250 crore (~USD 30M) per breach | EUR 20M or 4% global turnover |
| Enforcement body | Data Protection Board (adjudicatory) | Supervisory authorities (administrative) |
| Sensitive data categories | Not separately defined | Explicitly defined in Art. 9 |
| Right to data portability | Not explicitly provided | Art. 20 right |
| Right to object | Right to erasure and withdrawal (Sections 12-13) | Explicit right to object (Art. 21) |

## Industry Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- Extension to ISO/IEC 27001/27002 for privacy management
- Recommended framework for demonstrating "reasonable security safeguards" under Section 8(4)
- Maps controls to Indian data protection requirements

### Bureau of Indian Standards (BIS)
- **IS 17428:2020**: Data privacy assurance standard for Indian organisations
- Parts 1 and 2: Engineering and management requirements
- Developed to support compliance with Indian data protection framework

### CERT-In Directions (April 2022)
- **Indian Computer Emergency Response Team directives**
- Mandatory reporting of cybersecurity incidents within 6 hours of discovery
- Interacts with DPDP Act breach notification requirements
- Requires retention of ICT system logs for 180 days within India

## Enforcement Landscape

### Data Protection Board of India
- Established under Section 18 as a digital-first adjudicatory body
- Proceedings conducted digitally by default
- Chairperson and members appointed by the Central Government
- Appeals to TDSAT (Telecom Disputes Settlement and Appellate Tribunal)

### Early Enforcement Expectations
- Board adjudication process designed to be accessible and efficient
- Focus on systemic compliance failures and significant breaches
- Graduated enforcement approach expected (warnings before penalties)
- Penalty determination considers: nature of violation, gravity, significance, repetitive nature, and financial gain