One key aspect of the Act is the role of consent in data collection. As an organisation, you must obtain proper consent from the employee before obtaining any data. This is a significant requirement under the Act.

Consent Manager” means a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw her consent through an accessible, transparent, and interoperable platform.

Legitimate use of data:

• Using it for a specific purpose for which data is provided voluntarily.
• Used by the state or its instrumentalities to provide subsidy, benefit, service, certificate, license, or permit as may be prescribed to the data principal.
• Responding to any medical emergency
• Complying with the judgement
• Taking measures to provide safety during disasters.

Understanding the term' data fiduciary' is essential under the Act. A data fiduciary is a person authorised to determine the purpose and method by which personal data collected is processed. This is a critical concept in the Act.

• The data fiduciary must ensure that data must be processed legally and according to this Act, only for the purposes for which the data principal has provided consent.
• The data can also be processed for the legitimate uses mentioned in the provisions.

Any organisation that provides services and acquires and stores the personal data of parties and employees must comply with the provisions of this Act.

There is no ban on the transfer of personal data outside India.

There is no clear answer to this issue. However, the central government provides exemptions for certain data fiduciaries, including startups, based on the volume and nature of the processed personal data.

The data principal has the right to withdraw consent whenever necessary, which shall be provided since the consent provided by the data principal is the basis for processing the data.

The withdrawal of consent will not affect the legality of the data processed before the withdrawal.

Significant offences include data breaches and breaches of the obligations and duties of various parties.

Section 2(m) of this Act defines the term digital office. It is an office that follows an online mechanism, where the proceedings are conducted online, from initiating the complaint or intimation to disposing of the complaint.

The data fiduciary will be held liable if they have breached their obligations to take reasonable security safeguards to prevent security breaches. A penalty of up to 250 crore rupees may be imposed.

A complaint regarding a data breach can be filed with the Data Protection Board of India. The board conducts an inquiry and determines a monetary penalty based on the breach's nature, gravity, repetitiveness, and duration.

No, online shopping sites cannot cancel an order if the consent for providing personal data has been withdrawn if it has already been paid and processed. However, after withdrawing the consent, it can allow access to the website or applications for placing the order.

The personal data of the children must be processed only with the consent of parents or guardians. Children include any individual who has yet to complete the age of 18. The data fiduciary must not process any data that will detrimentally affect the child's well-being. They also should not track or conduct any behavioural monitoring on children.

Data principals are defined under Section 2(j) of the DPDP Act, 2023. They are the persons related to personal data; the data belongs to them. The data principal means a parent or lawful guardian in the case of a child and a lawful guardian acting on behalf of a person with a disability.

The definition of the term data protection officer was provided under Section 2(l) of the DPDP Act, 2023. The significant data fiduciary can appoint a data officer in necessary situations like:

• Representing the data fiduciary under the provisions of the Act.
• Being a point of contact for the grievance redressal mechanism under the provisions.
• Being an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary.

The following factors are taken into consideration by the Central Government while determining a significant fiduciary:

• The volume and sensitivity of personal data processed. 
• Risk to the rights of the Data Principal.
• Potential impact on the sovereignty and integrity of India;
• Risk to electoral democracy. 
• Security of the State. 
• Public order.