What Is the Digital Personal Data Protection (DPDP) Act?

Key Terms You Should Know

Data Fiduciary: Any entity, be it a company, organization, or government body, that collects, uses, or manages an individual’s personal data.
Data Principal: The individual whose personal data is being collected or used.
Telecom Disputes Settlement and Appellate Tribunal (TDSAT): The legal body where individuals can complain against the decisions of the Data Protection Board of India.
Grievance Redressal Mechanism: A formal process for individuals to file complaints and resolve their data-related issues.
Consent Manager: A registered entity that helps individuals give, manage, or withdraw consent for their personal data use.
Lawful Purpose: A valid and legally permitted reason to collect or use personal data.
Legitimate Use: Specific situations where data can be used without consent, like for government services or emergencies.

Key Terms You Should Know:

Data Fiduciary: Any entity, including a company, organization, or government body, that collects, processes, or manages an individual’s personal data.
Data Principal: The individual whose personal data is being collected, stored, or used.
Telecom Disputes Settlement and Appellate Tribunal (TDSAT): The legal authority where individuals can appeal against decisions made by the Data Protection Board of India.
Grievance Redressal Mechanism: A structured process that allows individuals to raise complaints and seek resolution for data protection issues.
Consent Manager: A registered intermediary that enables individuals to give, manage, review, or withdraw consent for personal data usage.
Lawful Purpose: A legally valid and permitted reason for collecting or processing personal data under the DPDP Act.
Legitimate Use: Defined scenarios where personal data may be processed without explicit consent, such as government functions or emergency situations.

Highlights

The Digital Personal Data Protection Act, India, 2023, is the first comprehensive law in India that focuses on digital personal data.
It sets individual rights, defines organization duties, and introduces penalties for misuse.
The Digital Personal Data Protection Rules, 2025, implement the law by clarifying rules for consent, breach reporting, and enforcement.
Together, the Act and Rules aim to prevent data misuse, build digital trust, and support innovation in India’s digital economy.

Highlights:

The Digital Personal Data Protection Act, India, 2023 is the first comprehensive law in India focused exclusively on digital personal data.
It establishes individual data rights, defines organizational responsibilities, and introduces penalties for data misuse.
The Digital Personal Data Protection Rules, 2025 operationalize the Act by detailing consent management, data breach reporting, and enforcement mechanisms.
Together, the Act and Rules aim to prevent data misuse, strengthen digital trust, and support innovation in India’s digital economy.

What Is the Digital Personal Data Protection Act (DPDP Act 2023)?

The Digital Personal Data Protection Act, 2023 is India’s first completely detailed law for managing how digital personal data is collected, stored, used, and shared. Among the key digital personal data protection law benefits are stronger privacy safeguards for individuals and clear compliance rules that allow organizations to process data for legitimate purposes.

The Act is intended to balance individual rights with business and government requirements. It is inspired by global rules like the EU’s GDPR, but is specifically adapted for India.

brudata

4.5

Starting Price

$ 25.00

1. Scope and Applicability

The DPDP Act applies to digital personal data processed within India. It also applies to organizations outside India if they offer goods or services to Indian users or monitor their behavior. The Act does not cover purely offline data, personal data used for private purposes, or data made public by the individual or under legal obligation.

Consent is the cornerstone of the Act. Companies can only use personal data if they have clear consent from an individual for a specific legal reason. Individuals have complete right to withdraw their consent at any time. Exceptions exist for legitimate uses, such as government services, medical emergencies, and legal compliance.

For children under the age of 18, verifiable consent from their parents is mandatory. The law also prohibits harmful processing or targeted advertising directed at minors.

3. Rights of Individuals

Data Principals, individuals whose personal data is taken, have several key rights. They can access their data, ask for corrections/deletion, and even nominate someone to manage these rights on their behalf in case there is an incident of death or incapacity. One can also complain if they find their data is being misused. In return, the law expects them to give true information and not make false complaints.

TrustArc

4.1

Starting Price

Price on Request

4. Obligations of Organizations

Data Fiduciaries, entities that collect or process personal data, must maintain data accuracy, use strong security, and delete the data if it is no longer needed. Significant Data Fiduciaries (those managing sensitive or huge amounts of data) have extra duties. These include hiring a Data Protection Officer, performing regular audits, and conducting data protection impact assessments.

5. Penalties Under the DPDP Act

The DPDP Act imposes heavy penalties for non-compliance. These penalties could range from INR 50 crore to INR 250 crore for issues like poor data security, not reporting data breaches, or violating children’s data rules. Data privacy tools can be helpful in managing compliance, securing personal data, and reducing the risk of such penalties.

6. Data Protection Board of India

The Act sets up the Data Protection Board of India (DPBI) to watch over compliance. The Board’s job is to monitor breaches, resolve complaints, and issue penalties. Individuals can appeal against its decisions to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Secuvy AI

4.4

Starting Price

Price on Request

History & Why India Introduced the DPDP Act?

The ‘Right to Privacy’ was declared a fundamental right by the Supreme Court of India on 24 August 2017 in the case of Justice K. S. Puttaswamy (Retd.) vs Union of India.

After this, the government started creating a data protection framework and constituted a committee of experts under Justice B.N. Srikrishna on 22 December 2018.

The committee released white papers, asked for public feedback, and submitted its report. It led to the drafting of the Personal Data Protection Bill in 2018 and its revised version in 2019.

After cabinet approval and parliamentary deliberations, the 2019 Bill was withdrawn in August 2022, and a new draft was released for consultation in November 2022.

The Digital Personal Data Protection Act, 2023, was introduced, passed by both houses, and received Presidential assent on 11 August 2023.

Its implementation continued with the release of the DPDP Rules, 2025, to operationalize the law.

What’s New?

The Digital Personal Data Protection Rules, 2025, were recently notified, marking the start of implementation of the DPDP Act, 2023. The rules mainly set timelines and procedures for consent, breach reporting, and grievance handling.

Organizations are provided with some time to implement these rules while individuals get certain rights to understand how the organizations manage their data.

By focusing on citizens, the framework gives people clear control over how their personal information is collected, used, and shared.

Who Must Comply with the DPDP Act? Entities, Persons & Applicability?

The DPDP Act applies to almost every organization handling digital personal data related to India. This includes private companies, startups, e-commerce platforms, financial institutions, healthcare providers, and telecom companies.

Government departments and regulatory bodies are also covered, subject to specific exemptions. Foreign companies offering goods or services to people in India must comply, even if their data processing systems are located overseas.

What Is Covered & Not Covered Under the DPDP Act?

Covered Under DPDP Act, 2023	Not Covered Under DPDP Act, 2023
Digital personal data collected online	Personal data processed in purely offline form
Personal data collected offline and later digitized	Personal data used for personal or domestic purposes
Personal data of individuals within India	Data made publicly available by the Data Principal
Personal data processed outside India to offer goods or services in India	Data made public under a legal obligation, for example, court records
Processing by private companies, startups, and government bodies	Non-personal or anonymised data
Data processed with consent or for legitimate uses	Processing for research, archiving, or statistical purposes (subject to exemptions)
Children’s personal data (with parental consent)	Data relating to foreign nationals processed under a foreign contract

Conclusion

The Digital Personal Data Protection Act, 2023 creates a structured and modern framework to protect personal data in India. With clear rights, responsibilities, and penalties, it strengthens trust between individuals and organizations.

The Digital Personal Data Protection Rules, 2025 bring practical clarity to compliance, enforcement, and grievance redressal. Together, they position India as a responsible digital economy that values privacy while enabling innovation and growth.