Digital Personal Data Protection Act, 2023 – Context and Key Features The Digital Personal Data Protection Act, 2023 is India’s first comprehensive law aimed at protecting people’s personal data in the digital sphere. The digital economy is thriving, therefore increasing amounts of personal data are shared digitally, whether in an app, website or through other digital mechanisms. However, until now, there was no legal structure giving accountability to organisations in relation to the use of that data. The act was lobbied for and delivered after the 2017 ruling in which the Supreme Court made privacy a fundamental right. Increasing cases of ‘data breach,’ the misuse of people’s personal data, and international contingencies, like the highly publicised GDPR, highlighted the need for India to have its own, independent, law to protect personal data. Some of the important features of the Act are: It is applicable to all digital personal data, even where processed outside India; Consent is foregrounded – organisations must obtain permission from individuals before processing their data, with some exceptions; Individuals have rights to access, rectify, and erase their data; children’s data has an additional level of protection; Data Protection Board to oversee complaints and enforcement; and. Severe fines up to ₹250 crore (approximately $30 million) for serious offence. The law is a strong start but it will be interesting to see the tangible impact with the public’s ongoing engagement.