A Study on Identity Theft in Relation to Digital Personal Data Protection Act, 2023

This paper explores the socio-legal ecosystem of identity theft in India, tracing the evolution of the threat landscape, the limitations of previous legal regimes, and the structural promises of the new legislative framework. The major objectives of the study are to assess the legal framework's agility in addressing emerging threats like Synthetic Identity Theft and AI driven deepfakes, to formulate evidence-based recommendations for the Data Protection Board to strengthen the enforcement regime and to examine the effectiveness of the existing legislations, tool & techniques that safe guard Identity Theft. While amending the Act is a legislative hurdle, the government can leverage the Consumer Protection Act, 2019 in tandem with DPDP. Currently, the DPB handles data compliance, and the Police handle identity theft (BNS). There is an operational silo. A formal information sharing protocol should be established between the Data Protection Board and the Indian Cyber Crime Coordination Centre (I4C). The Digital Personal Data Protection Act, 2023, marks a decisive, albeit imperfect, step towards maturing India’s digital economy. By imposing high-cost penalties on negligence, it seeks to dry up the supply of stolen data that fuels the identity theft industry. Section 8’s security mandates and Section 33’s punitive caps effectively serve as a high wall against mass data breaches, forcing corporate India to internalize the cost of cybersecurity.