Abstract:The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s first comprehensive legislation governing the processing of digital personal data, marking a transformative shift from the fragmented regime under the Information Technology Act, 2000. Enacted in August 2023. This research paper critically examines the DPDP Act’s constitutional foundations, key provisions, enforcement mechanisms, and emerging challenges. Drawing upon the landmark Supreme Court judgment in K.S. Puttaswamy v. Union of India (2017), which recognized privacy as a fundamental right under Article 21, the paper analyzes the Act’s alignment with constitutional mandates. Through detailed examination of the Data Protection Board of India’s enforcement powers, the novel “negative list” approach to cross-border data transfers, and the amendment to the Right to Information Act, 2005, the paper identifies significant tensions between data protection and transparency. The study incorporates recent judicial developments, including the Madras High Court’s ruling on the right to be forgotten in Karthick Theodore v. Registrar General (2024). The paper concludes with recommendations for harmonizing the DPDP framework with constitutional rights, strengthening the independence of the Data Protection Board, and addressing ambiguities regarding algorithmic decision-making and artificial intelligence.

Keywords: Digital Personal Data Protection Act, 2023, right to privacy, Data Protection Board of India, cross-border data transfer, right to be forgotten, Right to Information Act, K.S. Puttaswamy judgment, Karthick Theodore judgment, data fiduciary, data principal, consent manager.