And Law Offices

03/06/2026

02/06/2026

🔐 From the 2019 Bill to the DPDP Act, 2023: India's Data Protection Journey

In August 2022, the Government withdrew the Personal Data Protection Bill, 2019 after extensive parliamentary review and recommendations by the Joint Parliamentary Committee. This was not a step back—it was a move towards creating a more practical and streamlined data protection framework.

📌 The result? The Digital Personal Data Protection Act, 2023, India's first dedicated law governing digital personal data.

Key highlights: ✅ Applies to digital personal data
✅ Establishes the Data Protection Board of India
✅ Introduces a penalty-based enforcement framework
✅ Permits cross-border data transfers (subject to restrictions)
✅ Provides structured compliance and grievance mechanisms

The evolution from the 2019 Bill to the DPDP Act reflects India's effort to balance privacy, innovation, digital governance, and economic growth in an increasingly connected world. 🌐

19/05/2026

The Digital Personal Data Protection (DPDP) Act, 2023 is not just a new law — it is the result of India’s long constitutional and legislative journey towards protecting the Right to Privacy in the digital age.

The foundation of this framework was laid by the landmark Justice K.S. Puttaswamy v. Union of India (2017) judgment, where the Supreme Court declared privacy as a Fundamental Right under the Constitution of India.

Following this, the Justice B.N. Srikrishna Committee was formed to recommend a strong data protection framework for the country. This led to the Draft Personal Data Protection Bill, 2018, which introduced key principles such as: • Rights of individuals over their personal data
• Duties and accountability of organisations processing data
• Consent-based data processing
• Cross-border data transfer regulations
• Creation of a Data Protection Authority

The rapid growth of digital governance, Aadhaar-linked services, smartphones, fintech platforms, e-commerce, and online transactions made a comprehensive data protection law a necessity for India.

The DPDP Act, 2023 now represents India’s evolving approach towards balancing innovation, governance, and protection of individual privacy rights in an increasingly digital ecosystem.

🔐 Privacy is no longer only a personal concern — it is now a constitutional and compliance imperative.



Read full blog here : https://and.ind.in/the-digital-personal-data-protection-dpdp-act-2023constitutional-roots-and-legislative-evolution/

20/03/2026

DPDP Act, 2023 🔐 | Consent is NOT Just a Checkbox

In today’s data-driven world, consent = compliance.

Under the DPDP Act, valid consent must be:
✔️ Free
✔️ Specific
✔️ Informed
✔️ Unambiguous
✔️ Given through clear affirmative action

👉 If consent violates any law — it’s invalid.

🗣️ Clarity is Mandatory
Consent requests must be in simple language and accessible in multiple Indian languages — ensuring true understanding, not confusion.

📞 Accountability Matters
Every consent request must include contact details of a Data Protection Officer (DPO) or authorised person.
For Significant Data Fiduciaries, a DPO in India is mandatory.

🔁 Right to Withdraw = Real Control
Users can withdraw consent anytime.

Once withdrawn → data processing must stop (unless legally permitted).

📢 NOTICE: The Backbone of Transparency
Before or along with consent, a clear notice must inform users:
• What data is being collected
• Why it is being processed
• How rights can be exercised
• How to file complaints

📌 Must be:
✔️ Clear & standalone
✔️ Easy to understand
✔️ Detailed (data + purpose clearly defined)

🌐 It should also provide:
• Link to website/app
• Easy option to withdraw consent
• Mechanism to exercise rights

💡 Key Insight:
DPDP shifts power to users —
No clarity = No consent = Non-compliance

Follow for more

ANDLawOffices