In the current digital era, data protection has emerged as an indispensable aspect of both individual privacy and national security. This research paper presents a comparative analysis of the evolutionary trajectory of India's legal framework ranging from the erstwhile Section 43A of the Information Technology (IT) Act, 2000, to the new Digital Personal Data Protection (DPDP) Act, 2023. The primary objective of this study is to examine the shifting dynamics between 'Corporate Liability' and 'State Immunity.'

The study indicates that while Section 43A imposed limited civil liability on 'Body Corporates,' the DPDP Act, 2023, has tightened corporate accountability by imposing hefty penalties and statutory duties through the concept of a 'Data Fiduciary.' However, a significant 'research gap' that emerges is the scope of 'State Immunity’. This research highlights how the broad exemptions granted to government agencies under the new law in the name of 'national security' and 'public order' create an 'accountability gap' that stands in contrast to the strict regulations imposed on private corporations. Furthermore, this paper analyzes the shift from the 'compensation-based model' of the IT Act to the 'penalty-based model' of the DPDP Act i.e. a transition that prioritizes the State exchequer over aggrieved citizens. Ultimately, this research paper argues that a balanced data protection framework necessitates ensuring equal accountability for both the State and corporations, thereby safeguarding against the infringement of the 'Right to Privacy' within the context of India's digital inclusion.