Comparative Analysis of Digital Data Protection Legislations Across Various Jurisdictions: Rethinking India's Digital Personal Data Protection Act, 2023

Abstract

This article examines India's Digital Personal Data Protection Act, 2023 through two lenses — the domestic approach and the global approach. Adopting a doctrinal and comparative method, it situates India's data protection regime within the broader context of global data flows, drawing on infrastructure and trade data to show how developed economies, particularly the United States, hold disproportionate control over data originating in developing countries such as India. This asymmetry, examined through the lens of data colonialism, is argued to raise concerns of economic value extraction and legal sovereignty that a purely privacy-focused reading of the DPDP Act overlooks. The article then turns inward, tracing the Act's legislative history from the Puttaswamy judgment through to its 2023 enactment, and identifies specific doctrinal gaps that limit its protective force: the absence of a sensitivity-based data category, an executive-appointed and currently non-functional Data Protection Board, an overbroad state-security exemption under Section 17, and a permissive and largely dormant cross-border transfer regime under Section 16 — illustrated through the practical difficulties these gaps create for citizens seeking redress in the Parth Sharma litigation. It concludes that meaningful reform requires judicial involvement in institutional design, a functioning cross-border enforcement framework, and greater legal sensitivity toward individual data subjects.