Digital Personal Data Protection Bill, 2023: Impact on the Startup Ecosystem

The Digital Personal Data Protection Bill, 2023 (DPDP Bill) is a landmark piece of legislation that seeks to protect the privacy of individuals’ digital personal data. The Bill has been passed by both houses of Parliament and is awaiting the President’s assent. Once it comes into force, the DPDP Bill will be one of the most comprehensive data protection laws in the world.

Scope of applicability of the law

The DPBP applies to all entities that collect, process, or store personal data, regardless of their size or location. However, there are certain exemptions, such as for government agencies and certain non-profit organisations.

Data protection and Use

Industries that will experience the greatest impact:

The DPBP will have the biggest impact on sectors that rely heavily on personal data, such as:

1. E-commerce
2. FinTech
3. Healthcare
4. Social media
5. Edtech
6. AI
7. Data and IT services

Impact on companies, data, IT services, AI, information sharing, and publishing:

Companies in the affected sectors will need to make changes to their data collection and processing practices to comply with the DPBP. This may include:

• Obtaining consent from individuals before collecting or using their personal data
• Storing personal data securely
• Giving individuals access to their personal data
• Deleting personal data when it is no longer needed

The DPBP will also impact how companies share data with each other and with third parties. Companies will need to ensure that they have legal grounds to share data and that they have appropriate safeguards in place to protect the data.

Startups that will benefit from the policy:

The DPBP will benefit startups that are committed to protecting the privacy of their users. The bill will help startups to build trust with their users and differentiate themselves from their competitors.

How does the DPBP protect the data of consumers?

The DPBP protects the data of consumers by giving them more control over how their data is collected, used, and shared. Consumers will have the right to:

• Access their personal data
• Correct their personal data
• Delete their personal data
• Restrict the processing of their personal data
• Object to the processing of their personal data

Will the DPBP limit or restrict the growth of data, technology, sharing of information or otherwise?

The DPBP is not intended to limit or restrict the growth of data, technology, or the sharing of information. However, it does require companies to take steps to protect the privacy of individuals’ personal data.

Here are some examples of how the DPBP will apply to the startup ecosystem:

1. A social media startup will need to obtain consent from its users before collecting or using their personal data. The startup will also need to give its users access to their personal data and delete it when it is no longer needed.
2. A FinTech startup will need to obtain consent from its customers before collecting or using their financial data. The startup will also need to store the data securely and have appropriate safeguards in place to protect it from unauthorised access, use, or disclosure.
3. A healthcare startup will need to obtain consent from its patients before collecting or using their medical data. The startup will also need to store the data securely and have appropriate safeguards in place to protect it from unauthorised access, use, or disclosure.

What investors need to be diligent or aware of, before investing in a company?

Investors need to be aware of the following when investing in a company that collects, processes, or stores personal data:

• Whether the company has a privacy policy in place and whether it complies with the DPBP
• What types of personal data the company collects and how it is used
• How the company stores and protects personal data
• How the company shares personal data with third parties

Critical information for readers/users:

The DPBP is a complex piece of legislation, but there are a few key things that readers and users should know:

• The DPBP gives you more control over your personal data.
• You have the right to access, correct, delete, and restrict the processing of your personal data.
• You have the right to object to the processing of your personal data.
• Companies that collect, process, or store your personal data must comply with the DPBP.
• You can file a complaint with the Data Protection Authority if you believe that your privacy rights have been violated.

Conclusion:

The DPBP is a significant piece of legislation that will have a major impact on the startup ecosystem in India. Startups need to take steps to comply with the bill in order to protect the privacy of their users and build trust.

To know more about Startups, Fund raise, Corporate support and more, contact us at www.instarto.com or +919929527757 or info@instarto.com

Written by: Parija Gupta & Ayush Dadhich

Keep reading and liking us!