Digital Personal Data Protection Act 2023 (DPDP Act 2023) - Ministry of Law and Justice

35. No suit, prosecution or other legal proceedings shall lie against the Central Government, the Board, its Chairperson and any Member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder.

36. The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

37. (1) The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the Board that—

(a) intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances; and
(b) advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India,

after giving an opportunity of being heard to that Data Fiduciary, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information.

(2) Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same.

(3) For the purposes of this section, the expressions “computer resource”, “information” and “intermediary” shall have the meanings respectively assigned to them in the Information Technology Act, 2000.

38. (1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.

(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.

39. No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act.

40. (1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.

(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—

(a) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5
(b) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5;
(c) the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6;
(d) the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6;
(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7;
(f) the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8;
(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;
(h) the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8;
(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;
(j) the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9;
(k) the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;
(l) the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;
(m) the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11;
(n) the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12;
(o) the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13;
(p) the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14;
(q) the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17;
(r) the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19;
(s) the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20;
(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;
(u) the terms and conditions of appointment and service of officers and employees of the Board under section 24;
(v) the techno-legal measures to be adopted by the Board under sub-section (1) of section 28;
(w) the other matters under clause (d) of sub-section (7) of section 28;
(x) the form, manner and fee for filing an appeal under sub-section (2) of section 29;
(y) the procedure for dealing an appeal under sub-section (8) of section 29;
(z) any other matter which is to be or may be prescribed or in respect of which provision is to be, or may be, made by rules.

41. Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the rule or notification or both Houses agree that the rule or notification should not be made or issued, the rule or notification shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule or notification.

42. (1) The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.

(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification.

43. (1) If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty.

(2) No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act.

(3) Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament.

44. (1) In section 14 of the Telecom Regulatory Authority of India Act, 1997, in clause (c), for sub-clauses (i) and (ii), the following sub-clauses shall be substituted, namely:—

“(i) the Appellate Tribunal under the Information Technology Act, 2000;
(ii) the Appellate Tribunal under the Airports Economic Regulatory Authority of India Act, 2008; and
(iii) the Appellate Tribunal under the Digital Personal Data Protection Act, 2023.”.

(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:—

(a) section 43A shall be omitted;
(b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and
(c) in section 87, in sub-section (2), clause (ob) shall be omitted.

(3) In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:—

“(j) information which relates to personal information;”

Miscellaneous