Examkin

Question

Difficulty: Very hardNational Events, Acts, and Governance Initiatives

With reference to the Digital Personal Data Protection (DPDP) Act, 2023 enacted by the Parliament of India, consider the following statements:

1. It establishes the Data Protection Board of India (DPBI) as a digital-by-design body to adjudicate non-compliance and impose financial penalties.
2. Appeals against orders issued by the Data Protection Board of India are directed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
3. The Act mandates strict data localization requiring all personal data of Indian citizens to be stored and processed exclusively within the physical territory of India.

Which of the statements given above is/are correct?

  1. 1 and 2 onlyAnswer
  2. B
    2 and 3 only
  3. C
    1 and 3 only
  4. D
    1, 2 and 3

Answer

Statements 1 and 2 only are correct.
Statements 1 and 2 accurately state statutory provisions under the DPDP Act, 2023. The Data Protection Board of India (DPBI) is the primary adjudicatory body for non-compliance, and its decisions are appealable to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Statement 3 is false because the 2023 Act permits cross-border transfer of personal data by default, unless the Central Government explicitly restricts transfers to specific countries/territories.

Step-by-Step Solution

1
Analyze Statement 1 regarding the adjudicatory body under the DPDP Act, 2023.
Statement 1 is correct. The Act provides for the establishment of the Data Protection Board of India (DPBI) to function as a digital-by-design body for inquiry, adjudication of non-compliances, and imposition of financial penalties.
Section 18 of the DPDP Act, 2023 authorizes the Central Government to establish the Data Protection Board of India.
2
Analyze Statement 2 regarding the appellate mechanism.
Statement 2 is correct. Instead of creating a new appellate tribunal, the Act mandates that appeals against decisions of the Data Protection Board shall lie before the existing Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Section 29 of the DPDP Act, 2023 designates TDSAT as the appellate authority to streamline administrative overhead.
3
Analyze Statement 3 regarding cross-border data flows and data localization.
Statement 3 is incorrect. The DPDP Act, 2023 adopts a negative list (blacklisting) approach for cross-border data transfers, permitting data transfers to countries/territories outside India unless specifically restricted by a notification from the Central Government.
Section 16 of the DPDP Act, 2023 shifted away from the strict hard data localization regime proposed in earlier draft bills (e.g., 2018 and 2019 drafts).

Key Concept

Key provisions and statutory architecture of the Digital Personal Data Protection (DPDP) Act, 2023
Estimated Time:1m 30s
Rate this question

Topics

National Events, Acts, and Governance Initiatives

More questions from this topic