Examkin

Question

Difficulty: HardNational Events, Acts, and Governance Initiatives

With reference to the landmark Digital Personal Data Protection (DPDP) Act, 2023 in India, consider the following statements:

1. It applies to the processing of digital personal data within India, as well as data processed outside India if it involves offering goods or services to data principals in India.
2. The Data Protection Board of India acts as the administrative body to determine non-compliance, whereas appeals against its decisions lie before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
3. The Act explicitly mandates that consent is strictly indispensable under all circumstances, prohibiting any personal data processing for state benefits or public emergencies without prior consent.

Which of the statements given above is/are correct?

  1. 1 and 2 onlyAnswer
  2. B
    1 and 3 only
  3. C
    2 and 3 only
  4. D
    1, 2 and 3

Answer

The statement combination containing '1 and 2 only' is correct.
The combination indicating statement 1 and statement 2 only is correct because the DPDP Act, 2023 applies to digital personal data processed within India as well as foreign processing targeting Indian residents. Furthermore, the Data Protection Board of India handles primary non-compliance inquiries, and appeals against its orders lie directly with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Statement 3 is false because Section 7 allows processing without consent for specified legitimate uses such as public health emergencies and state benefit disbursement.

Step-by-Step Solution

1
Evaluate Statement 1 regarding territorial scope.
Statement 1 is correct. Section 3 of the Digital Personal Data Protection Act, 2023 specifies that the Act applies to digital personal data processed within India, as well as processing outside India if it relates to offering goods or services to data principals located within India.
Territorial jurisdiction includes extra-territorial application for cross-border digital services targetting Indian residents.
2
Evaluate Statement 2 regarding institutional mechanism and appellate tribunal.
Statement 2 is correct. The Act provides for the establishment of the Data Protection Board of India (DPBI) as an adjudicatory body for inquiry and penalties, and designates the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) as the Appellate Tribunal to hear appeals against DPBI orders.
Institutional hierarchy maps DPBI for primary adjudication and TDSAT for statutory appeals.
3
Evaluate Statement 3 regarding consent exemptions.
Statement 3 is incorrect. Section 7 of the Act outlines 'Certain Legitimate Uses' where personal data may be processed without explicit consent, such as for responding to medical emergencies, epidemic control, breakdown of public order, or state provisioning of subsidies, benefits, and services.
The Act recognizes specific non-consent grounds to prevent governance deadlock during emergency and statutory service delivery.

Key Concept

Digital Personal Data Protection Act, 2023 - Scope, Adjudication Framework, and Legitimate Uses
Estimated Time:1m 30s
Rate this question

Topics

National Events, Acts, and Governance Initiatives

More questions from this topic