Data protection and cybersecurity

Every online service collects personal data: names, locations, purchases, health information and biometric details. The Digital Personal Data Protection Act of 2023 is India's first comprehensive law for digital personal data. It received presidential assent on 11 August 2023, after the Supreme Court held in the Puttaswamy decision of 2017 that privacy is a fundamental right under the Constitution. The Act's stated purpose is to balance the individual's right to protect personal data with the need to process such data for lawful purposes.

The Act uses two key roles. The data principal is the individual whose data is processed; the data fiduciary is the organisation that decides why and how data is processed. Processing generally requires consent that is free, specific, informed and unambiguous, with notice in clear language. Data principals have rights to access, correct and erase their data, and to seek redress. A Data Protection Board of India is provided for enforcement, and the Act sets large financial penalties for breaches, up to 250 crore rupees for a failure to protect data. Its provisions are brought into force in phases, so the working rules and the Board's practice should be checked at the time of reading.

The Act sits alongside older law. The Information Technology Act of 2000, as amended, deals with computer crime, intermediary liability and electronic records, and the IT Rules of 2021 set duties for social media platforms and other intermediaries, including grievance officers and content takedown procedures. The Indian Computer Emergency Response Team, CERT-In, set up in 2004, coordinates responses to cyber incidents and issues directions on reporting. The National Cyber Security Policy dates to 2013, and a newer strategy has been under discussion, reflecting how quickly threats change.

Cybersecurity threats range from phishing and ransomware against hospitals and firms, to attacks on power, banking and government networks, to disinformation campaigns. Defence is layered: secure software, updated systems, trained staff, incident reporting, and backup and recovery plans. No single law or agency can prevent all attacks, which is why the system depends on firms reporting incidents promptly and on users recognising fraud.

For civil studies, the central tension is between protection and utility. Data powers welfare delivery, credit, health research and policing, but the same data can be misused for surveillance, profiling or fraud. A good answer will show how consent, purpose limitation, data minimisation and independent enforcement are meant to hold that tension, and where critics say the Act's exemptions for the state weaken it.