Data Privacy and Protection Laws in India is part of Information and Communication Technology. Below are notes on 2 sub-topics, followed by practice MCQs from State PSC and UPSC papers.

Digital Personal Data Protection Act, 2023 (DPDP Act): Core principles

  • DPDP Act, 2023: Digital Personal Data Protection Act, 2023.
  • Objective: Govern processing of digital personal data; balance individual right to data protection & need for lawful data processing.
  • Key Entities: Data Principal (individual), Data Fiduciary (determines purpose/means), Data Processor (processes on behalf of Fiduciary).
  • Core Principles:
    • Consent: Processing of personal data generally requires free, informed, specific, unambiguous, and revocable consent from Data Principal.
    • Lawful Purpose: Processing must be for a legitimate and specified purpose.
    • Purpose Limitation: Data collected for a specific purpose cannot be used for unrelated purposes without fresh consent.
    • Data Minimisation: Only collect personal data necessary for the stated purpose.
    • Accuracy & Completeness: Data Fiduciaries must make reasonable efforts to ensure data is accurate and complete.
    • Storage Limitation: Data retained only as long as necessary for the purpose or as required by law.
    • Security Safeguards: Obligation on Data Fiduciaries to implement reasonable security measures to prevent data breaches.
    • Accountability: Data Fiduciaries are responsible for compliance with the Act.
  • Data Principal Rights: Include right to access, correction, erasure of personal data, grievance redressal, and nomination.
  • Data Protection Board of India (DPBI): Established to adjudicate non-compliance and impose penalties.
  • Cross-border Data Transfer: Allowed to specified countries/territories by the Central Government.

IT Act, 2000 and Reasonable Security Practices and Procedures

  • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules, 2021):
    • Objective: Primarily to enhance online safety for users, particularly women and children.
    • Key Provisions:
      • Intermediaries must explicitly convey certain requirements in their terms and conditions.
      • Enable aggrieved individuals to report content breaching physical privacy (e.g., revenge porn, similar content).
      • Intermediaries are mandated to remove or disable access to such reported content within 24 hours of receiving a complaint.
      • Traceability Provision: Obligates Significant Social Media Intermediaries (SSMIs) to enable the identification of the 'first originator' of information on their platform.
      • This provision is invoked only upon a legal order (court or competent authority).
      • Applicable for specific purposes like India's sovereignty, security, public order, or sexually explicit content.

12. Digital Payments and Fintech (UPI,

BHIM, AEPS)

Practice MCQs: Data Privacy and Protection Laws in India

Digital Personal Data Protection Act, 2023 (DPDP Act): Core principles

  1. What is the expansion of DPDP Bill which was cleared by the Cabinet recently?

    Asked in: GS JR Manager APGCL 12 2023 dated 25 04 2023 · Assistant Professor Exam 2022

    1. Digital Personal Data Protection Bill
    2. Dual Personal Data Protection Bill
    3. Direct Personal Data Protection Bill
    4. Diplomatic Personal Data Protection Bill
    Show answer

    Answer: A. Digital Personal Data Protection Bill

    The Digital Personal Data Protection Bill, 2023, aims to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes. Cybercrime refers to any criminal activity that involves computers, networked devices, or a network. Phishing involves deceptive communication to trick individuals into revealing sensitive information. Ransomware is a type of malware that encrypts a victim's files and demands a ransom for their decryption.

  2. Which of the following is not a cybercrime ?

    Asked in: State Forest Service Main Examination 2019

    1. Cyber terrorism
    2. Interpreter
    3. Data theft
    4. Forgery
    Show answer

    Answer: B. Interpreter

    Cybercrimes involve illegal activities committed using computers or the internet. An interpreter is a legitimate software tool.

IT Act, 2000 and Reasonable Security Practices and Procedures

  1. Consider the following statements from IT rules, 2021. 1. The new IT Rules, 2021 have a clear objective of enhancing online safety of users, particularly women & children. 2. Various provisions of these Rules include: Specific inclusion of certain requirements to be explicitly conveyed in the terms and conditions, Reporting by the aggrieved individual in respect of revenge porn and similar content breaching physical privacy and taking action within 24 hours for content removal. Select the correct answer using the code given below:

    Asked in: GPSC Prelims CSP 2 2023

    1. Only 1 is correct
    2. Only 2 is correct
    3. Both 1 and 2 are correct
    4. Neither 1 nor 2 is correct
    Show answer

    Answer: C. Both 1 and 2 are correct

    Statement 1 correctly identifies a primary objective of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which is to enhance online safety, with a particular focus on the safety of women and children. Statement 2 lists specific provisions found within the IT Rules, 2021, including the requirement for intermediaries to explicitly convey certain conditions in their terms of service, and mandates expeditious action (within 24 hours) on complaints regarding non-consensual explicit content (like revenge porn) or content depicting individuals in certain vulnerable situations, ensuring physical privacy.