Upon Commencement of the DPDP Act 2023, Which Existing Provision Stands Repealed?

Upon commencement of the Digital Personal Data Protection Act, 2023, Section 43A of the Information Technology Act, 2000 and the related SPDI Rules, 2011 stand repealed. Section 44(2)(a) of the DPDP Act mandates the omission of Section 43A. Search queries frequently ask if the new law repeals Section 66A, Section 79, or Section 72A of the IT Act. Those assumptions are incorrect. The DPDP Act specifically targets the older corporate data security framework. Section 43A previously required bodies corporate to pay compensation if their negligence in implementing reasonable security practices caused wrongful loss. The new legal framework abandons this civil compensation model entirely. The Data Protection Board of India now imposes administrative penalties for breaches of statutory duty.

The DPDP Act introduces broader amendments to existing telecommunications and technology statutes. Section 44(1) modifies Section 14 of the Telecom Regulatory Authority of India Act, 1997. It substitutes specific sub-clauses to route appeals through newly designated authorities. The Appellate Tribunal under the Digital Personal Data Protection Act, 2023 assumes jurisdiction over appeals against Data Protection Board orders. Section 44(2)(b) alters Section 81 of the Information Technology Act. It inserts the Digital Personal Data Protection Act, 2023 into the proviso alongside the Patents Act, 1970. This structural adjustment establishes legislative supremacy when provisions overlap.

Section 1 of the DPDP Act controls the mechanics of its commencement. The Central Government holds the authority to notify different enforcement dates for different provisions in the Official Gazette. Any reference within a specific provision to the commencement of the Act means the date that specific provision comes into force. This phased approach requires companies to track multiple notification dates. Organizations cannot rely on a single effective date for their compliance roadmaps. The staggered implementation forces businesses to adapt continuously. A company might need to set up notice mechanisms weeks before the breach reporting duties activate.

Section 3 defines the territorial and material application of the new framework. The Act applies to the processing of digital personal data within the territory of India. It covers personal data collected in digital form. It also covers personal data collected in non-digital form and digitized later. Offline data kept entirely in physical files remains outside the scope of the Act. The law extends its reach past national borders under specific conditions. Processing digital personal data outside the territory of India falls under the Act if it connects to offering goods or services to Data Principals within the territory of India.

The legislation explicitly excludes two broad categories of data processing under Section 3(c). The Act does not apply to personal data processed by an individual for any personal or domestic purpose. Public data receives different treatment. The law excludes personal data made publicly available by the Data Principal to whom such personal data relates. It also ignores data made publicly available by a person under a legal obligation. Statutory disclosures remain exempt. A government database published under a legal mandate does not trigger DPDP Act compliance duties for the publishing entity.

The repeal of the SPDI Rules, 2011 forces organizations to overhaul their data classification systems. The old rules defined specific health, financial, and biometric information as a distinct class requiring special handling. The DPDP Act, 2023 eliminates this legal distinction entirely. It does not create separate data tiers. Standard processing obligations apply uniformly to all digital personal data regardless of its nature. The Data Protection Board evaluates compliance based on the volume and risk factors of the processing activity. Large platforms managing massive datasets might face Significant Data Fiduciary designation. The personal data itself lacks formal legal tiers. Consent and legitimate uses set the boundaries for processing operations under the new regime.

Seed and Series B founders often view legal updates as administrative overhead. Enterprise customers take a stricter approach. Procurement teams continually update their security questionnaires to require DPDP Rules, 2025 compliance. A prospective B2B client will demand proof of verifiable notice workflows and vendor oversight records before signing a software contract. Consent remains the primary basis for processing personal data. Section 7 lists specific legitimate uses where consent is not required, such as medical emergencies or employment administration. Old policies cause problems. Outdated privacy documents that reference the repealed Information Technology Act will cause severe friction during investor due diligence.

Technical teams must execute specific steps to achieve enterprise readiness. Engineering leads map all digital personal data collected across the platform. This mapping identifies dormant databases. They document data flows from the initial collection point through to final encrypted storage. Developers implement itemised notice mechanisms before requesting user consent. Section 5 requires this notice to detail the specific personal data collected and the exact purpose of processing. The text must also provide contact details for the Data Protection Officer or designated representative. Users need clear instructions. The notice must include the procedure for Data Principals to make complaints to the Data Protection Board. The platform interface must allow users to view this information in English and any language specified in the Eighth Schedule to the Constitution.

Operational leads configure backend workflows to handle compliance events. The regulations require companies to report personal data breaches to the Data Protection Board and affected Data Principals within 72 hours. Organizations set up automated alert systems to meet this tight deadline. Founders evaluate all third-party vendor contracts to assign data processing duties. A Data Fiduciary remains legally responsible for the actions of its Data Processors. The contract must restrict the processor from using the personal data for any purpose other than what the fiduciary authorized. Audits verify this restricted processing.

The repeal of Section 43A removes civil compensation. The DPDP Act replaces it with severe administrative penalties. Schedule 1 of the Act sets maximum financial limits for specific infractions. A failure to take reasonable security safeguards to prevent a personal data breach carries a penalty of up to 250 crore rupees. Failure to notify the Board and affected Data Principals of a breach results in fines up to 200 crore rupees. Breaches of duties related to children attract fines up to 200 crore rupees. The Board considers multiple factors. It evaluates the nature, gravity, and duration of the non-compliance before issuing a final penalty order. The adjudicators also examine the type of personal data affected by the breach and any repetitive nature of the default.

Delaying compliance preparations puts your B2B sales pipeline at risk. The transition period is finite. Exactly 210 days remain until the DPDP hard compliance deadline of 13 May 2027. Building custom consent architectures consumes expensive engineering hours. Those hours directly compete with core product development. Automating these privacy requirements protects your cash runway and unblocks major enterprise deals. Companies can preview their current exposure against the DPDP Act, 2023 and Rules 2025 at https://www.complydp.com/audit-preview.