It's My Right: Personal Data Misused? Know Your Legal Rights And Remedies Under DPDP Act

It’s My Right: In today’s digital age, data is the new oil — powering everything from online shopping and banking to education and medical services. Every click, purchase, and interaction involves the exchange of personal information, making data one of the most valuable assets in the modern world.

Personal data is any information that can be used to identify someone, like your name, phone number, or even your shopping habits. Businesses and governments use this data to provide services, understand what people like, and offer personalised recommendations or ads.

ALSO READ: It’s My Right: Facing Harassment During WFH? How POSH Act Protects Employees Beyond Office Walls

How Is Personal Data Misused?

We have often heard of data leaks, certain businesses selling their customers’ data to third parties or businesses buying data to target a group of people, as personal data reveals individual preferences. Personal data leak also puts an individual at risk of identity theft, reputation damage, unfair targeting or judgment.

To protect common people from such threats, the Indian legislature brought the Digital Personal Data Protection Act, 2023. But a survey by PWC reveals that only 16 per cent of Indian consumers know about this Act and their rights. People do prioritise the safety of their data, with 44 per cent of consumers willing to pay more if their data is protected.

To understand the Digital Personal Data Protection Act, 2023, the rights it guarantees and legal remedies available to online consumers, The Daily Jagran spoke to Ankit Dev Arpan, a cyber lawyer and the Director of Lex Cyber Attorneys.

What Is Digital Personal Data Protection Act And How It Works

The Digital Personal Data Protection Act, 2023, is a law that tells companies and government bodies how they can collect, use, and store your personal data, like your name, phone number, location, or anything else that can identify you. The DPDP Act is meant to ensure accountability and protect individuals’ rights and applies to:

-Data collected online (from websites or apps)

-Data collected offline and later stored digitally

-Data collected outside India if it's used to offer goods or services within India

How Can Data Principal (You) Exercise Rights Under Act

The Act says that Data fiduciaries (the collector or processor of data) must provide individuals with an accessible grievance redressal mechanism to resolve issues related to data fiduciaries’ obligations.

If users find out and are suspicious of their data being processed and used without their consent, they can approach the Consent Manager appointed by the businesses and organisations to address the grievances of customers regarding the usage of personal data.

If consumers’ grievances are not resolved at the organisation level through the consent manager, they can approach the Data Protection Board (DPBI), an independent, specialised judicatory body.

Further recourse is available through the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) and finally the Supreme Court.

However, the Act grants an exemption to the state on grounds of national security to collect and process data.

Punishment Under Personal Data Protection Act

The DPBI can impose financial penalties up to Rs 250 crore if an organisation is found guilty by the Data Protection Board of India.

There are provisions of financial penalties up to Rs 10,000 against the Data Principal if they raise a false complaint or pretend to be someone else.

ALSO READ: It’s My Right: Legal Protections Every Woman Should Know During Arrest And Detention

Concerns Over DPDP Act

The DPDP Act exempts the government from its ambit, allowing the ruling dispensations to collect and process data on grounds of national security. This poses a threat to the fundamental right to privacy. Arpan said, “The Act's provision allowing the Central Government to issue broad exemptions via notification, rather than requiring case-by-case judicial or legislative authorisation, creates a significant legal loophole.”

He further said that the possibility of collecting data and processing it in the name of national security “underscores the need for stronger checks on executive power”.

Conclusion: While the Act raises certain concerns and is lesser known of, it is a step in the right direction. There’s a need to make the online consumers aware of their legal rights when it comes to protecting their personal data.

(Disclaimer: This article is part of the series 'It's My Right'. The views expressed in the article are for informational purposes only and do not constitute legal advice. To read more articles in the series, click here.)