Data usage and ground-rules: Inside India’s new Digital Personal Data Protection framework

A new law that defines how companies should process users’ data came into force with the President giving assent to the Digital Personal Data Protection (DPDP) Act passed by Parliament in the just-concluded monsoon session.

The law arms individuals with greater control over their data while allowing companies to transfer users’ data abroad for processing, except to nations and territories restricted by the Centre through notification.

It also gives the government power to seek information from firms and issue directions to block content. While the new law seeks to establish a robust framework for the protection of personal data in the digital realm, it has drawn criticism from some quarters over broad exemptions granted to state entities and some of its provisions diluting the landmark Right to Information (RTI) law.