Analytical study of digital personal data protection (DPDP) Act and and the relation with fundamental rights of people.
ABSTRACT :
When people take birth in this world from a child to being an adult , they get all kind of designations which become there personal identity. Now you all must be imagining that how it is related to DPDP act, let me give you an example. Think of when we open a new mobile app or open a bank account they always ask for our information such as your name, number, location and what not but have you ever imagined that what exactly these companies do with such Information. They actually take your data, track you and share it to others without giving you much control and in this manner people become easy targets of cybercrime such as hacking , online harassments or misusing your data which is actually your personal identity leaving the people in a vulnerable state. In simple words it means they steal your data and use it for their own profit. Therefore, our article aims to address the issue how your fundamental rights over digital identity are protected in India and the enforcement of DPDP Act.
INTRODUCTION :
Our article deals with a most powerful concept that is “ who is a Data Principal and our fundamental rights over your digital identity in India’s post DPDP Era ” that every citizen must know . The act under section 2 (j) defines data principal is someone who has a personal data which actually belongs to them . In simple words, we all are the data principal because we own those data’s and it is our personal belonging , we are the principals and hence known as data principal, when we give our information to someone else. If the data belongs to a child under 18 or a person disability, their parents or lawful guardians act on their behalf. When we talk about data principal it is also important to note that what other party . Under section 2 (i) The companies, apps, or government bodies that collects your data are known as Data Fiduciary. The word fiduciary comes from trust and by law these parties are obligated to act as trustworthy caretakers of our digital identity. Now if we talk about fundamental rights , these rights are duly given to us by our constitution. Under Article 21 ( Right to life and personal liberty ) we have right to privacy and it is related to data protection because all data are private and personal information of the people which is the duty of data fiduciary to maintain the confidentiality and it is the core principal of DPDP Act which ensures the protection.
BACKGROUND :
For many years before the DPDP Act came in India, there was no standalone law to govern this matter, during that time there was Information Technology Act,2000 which was outdated as internet was expanding rapidly and under this act it was not effective to manage the data, it was not built to handle modern smartphones, social media, or complex corporate algorithms. As internet world grew, the data protection becomes the main concern due to private corporations and mobile applications collected immense amounts of user data and treating the information as an unregulated commodity rather than a personal property. There were many incidents such as Global “GDPR” Wave (2018), then the WhatsApp-Facebook privacy scandal (2021) and other is the Chinese App bans & National security concerns, so altogether it forced the legislation to create a separate Act and it took around six years to come up with DPDP Act,2023.
LEGAL FRAMEWORK :
The structure of the Digital Personal Data Protection (DPDP) Act is built upon a balanced relationship between the individual and the entities handling their personal information. The law operates by classifying individuals as “Data Principals” the ultimate owners of their digital data and corporations, applications, or government bodies as “Data Fiduciaries,” who are legally obligated to act as trusted caretakers. To enforce these boundaries, the Act establishes the Data Protection Board of India (DPBI) to function as an independent watchdog capable of penalizing negligent companies up to ₹250 crores per violation. Following the formal notification of the DPDP Rules on November 14, 2025, this legal framework is rolling out in a phased timeline. The ecosystem introduces specialized intermediators known as “Consent Managers” by late 2026 to let users centralize their digital permissions, culminating in full corporate accountability and mandatory data erasure practices by mid-2027.
UNDERSTANDING YOUR FUNDAMENTAL RIGHTS :
In this framework we will be discussing a set of statutory rights meant for people which everyone should be aware of and designed in way to return the control of your digital identity back to you.
- Under section 11 of DPDP Act, 2023 states right to access information which ensures that you have the power to approach any company or platform and demand a explanation from them about what personal data they have collected from you and how it is being processed.
- Section 12 of DPDP Act, 2023, deals with correction and erasure of data. If any organization holds incomplete or wrong data of yours, you have the right to compel them to update or complete it. Also after the purpose is fulfilled for which you gave your data, you have the right to command the data fiduciary to erase your data from their server.
- Section 13 of DPDP Act, 2023, it involves grievance redressal which says if a company doesn’t follow the protocols of privacy or misuse your data so you have the right to file a formal complaint through the prescribed manner. If the matter is not solved internally then you also have the right to escalate the matter to data protection board of India for fair adjudication.
- Section 14 of DPDP Act,2023 talks about nomination, which is a forward looking safeguard beyond your control. It allows a designated trusted person to step into the shoes of data principal during his absence and exercise rights on behalf during the unfortunate event such as death, Physical Injury or mental Incapacity of data principal.
CASE ANALYSIS :
The case of Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) – In this case, Justice Puttaswamy, a 91-year-old retired High Court judge, challenged the government’s Aadhaar project, arguing that forcing citizens to give their biometrics (fingerprints and iris scans) to access basic state benefits was an extreme violation of their private lives. The government initially argued in court that the Indian Constitution did not explicitly guarantee a right to privacy. A historic 9-judge bench of the Supreme Court ruled unanimously against the government’s stance. They declared that Privacy is an inherent Fundamental Right under Article 21 (Right to Life and Personal Liberty). The Supreme Court explicitly directed the government to stop delaying and create a robust data protection law to safeguard citizens’ digital identities. The DPDP Act was born directly out of this judicial mandate.
CONCLUSION :
Hence, we can conclude that DPDP Act act as digital contract between you and internet which concerns about digital data only, consent is consider as primary tool, and make sure that there is a proper mechanism to solve the disputes. It is massive relief to the people where they can rest assure about their protection given by the law. It also make sures that the control remains in your hand and stops companies from misusing your data. The main gap they filled was that in the cybercrime era a data leak isn’t just annoyance but a threat to your life . You finally have the legal right to ask companies what data they have on, force them to fix mistakes, or tell them to delete it.
FAQs
- What is exactly DPDP Act,2023, and why was it created ?
The digital personal data protection act, 2023 is first standalone legal framework after replacing the outdated law of information technology act, 2000. It ensures protection of digital personal data. It act a shield between data principal and data fiduciary.
- What is the difference between “Data principal” and “Data fiduciary” ?
Data principal are those people who owns the personal data and if the data belongs to child under 18 or a person with disability then law guardians act as data principal on their behalf.
Data fiduciary are the companies or platforms that collect and process the data.
- What statutory rights do I have as a citizen under the DPDP Act, 2023 ?
The act returns the control of your digital identity back to you through four key rights:
- Right to Access Information (section 11)
- Right to correction and erasure (section 12)
- Right to grievance redressal (section13)
- Right to Nomination (section 14)
- What are the penalties for companies that violate this Act ?
To enforce the strict compliance the Data Protection Board of India (DPBI) as independent security. It has the authority to penalize negligent companies and Data Fiduciaries up to 250 crores per violation for failing to safeguard user data.
- What is the timeline for the full enforcement of these rules ?
Following the formal notification of the DPDP Rules got enforced on November 14, 2025 with introducing consent managers in late 2026 and expected to be full accountability takes effect by mid-2027.
