India Digital Personal Data Protection Act (DPDPA) 2023

Why does it matter?

The Act puts the burden of proof on the organization: where consent is the basis of processing, the Data Fiduciary must prove that notice was given and consent obtained in line with the Act (Section 6(10)). It also makes the Data Fiduciary responsible for processing done on its behalf by a Data Processor, whatever the contract says (Section 8(1)).

Key benefits include:

• Consent that can be withdrawn

A Data Principal can withdraw consent at any time, with ease comparable to giving it, and the Data Fiduciary must then cease processing and cause its Data Processors to cease (Section 6(4) and (6)).

• Rights with defined content

Section 11 gives a summary of the data and the identities of those it was shared with, Section 12 correction, completion, updating and erasure, Section 13 grievance redress and Section 14 nomination.

• Children and persons with disability

Verifiable consent of a parent or lawful guardian is required before processing, and tracking, behavioral monitoring and targeted advertising directed at children are barred (Section 9).

• Breach duties

A personal data breach must be intimated to the Board and each affected Data Principal (Section 8(6)), with a 72-hour detailed report to the Board under Rule 7(2)(b).

• Penalties by obligation

The Schedule sets penalties of up to ₹250 crore for failing reasonable security safeguards, ₹200 crore for breach intimation and children's obligations and ₹50 crore for other breaches.

How does it work?

A Data Fiduciary decides the purpose and means of processing. It gives a notice stating the personal data, the purpose, how rights are exercised and how to complain to the Board (Section 5), obtains consent or relies on a Section 7 legitimate use, and uses a Data Processor only under a valid contract (Section 8(2)). Consent can also be given, managed and withdrawn through a Consent Manager registered with the Board (Section 6(7) to (9)).

General obligations under Section 8 include ensuring completeness and accuracy of data used for decisions or disclosed to another Data Fiduciary (Section 8(3)), appropriate technical and organizational measures (Section 8(4)), reasonable security safeguards (Section 8(5)), erasure when consent is withdrawn or the specified purpose is no longer served (Section 8(7)), published contact details of a Data Protection Officer or other answering person (Section 8(9)) and a grievance mechanism (Section 8(10)). Rule 6 sets minimum safeguards: encryption, obfuscation or masking, access control, logging and monitoring, backups, and retaining logs for one year.

The Central Government can notify a Significant Data Fiduciary by volume and sensitivity of data and risk to Data Principals (Section 10). It must appoint an India-based Data Protection Officer and an independent data auditor and run periodic impact assessments, which Rule 13 sets at once every twelve months. The Board inquires into breaches and complaints and imposes penalties (Sections 27, 28 and 33), and the Central Government may restrict transfers to notified countries (Section 16).

Key Elements

• Applicability and grounds (Sections 3 and 4)

Digital personal data processed in India or in connection with offering goods or services to Data Principals in India; consent or certain legitimate uses.

• Notice and consent (Sections 5 to 7, Rules 3 and 4)

Itemized notice, availability in English or any Eighth Schedule language, consent standard, withdrawal, Consent Managers and Section 7 legitimate uses.

• Data Fiduciary obligations (Section 8, Rules 6 to 9)

Responsibility for processors, accuracy, security safeguards, breach intimation, erasure, contact point and grievance redress.

• Children (Section 9, Rules 10 to 12)

Verifiable parental or guardian consent, no tracking or targeted advertising, and exemptions in the Fourth Schedule.

• Significant Data Fiduciaries (Section 10, Rule 13)

India-based Data Protection Officer, independent data auditor, annual impact assessment and audit, and restricted transfer of data the Central Government specifies.

• Rights and duties of Data Principals (Sections 11 to 15, Rule 14)

Access, correction and erasure, grievance redress, nomination, and duties such as not filing false or frivolous complaints.

• Board, penalties and appeals (Sections 18 to 34, Rules 17 to 22)

Data Protection Board of India as a digital office, penalties set by the Schedule, voluntary undertakings (Section 32) and appeals to TDSAT within sixty days (Section 29).

What does it cover?

The Act covers any person, including individuals, companies, firms and the State, that processes digital personal data under Section 3. It does not apply to personal data processed by an individual for a personal or domestic purpose, or to data made publicly available by the Data Principal or under a legal obligation (Section 3(c)). Section 17 exempts defined cases, among them enforcing legal rights, offence investigation, notified State instrumentalities, research and statistical processing to set standards, and data of persons outside India processed under a foreign contract, and lets the Central Government notify classes, including startups, for partial exemption.

What are its objectives?

The Act's long title sets the objective: processing of digital personal data that recognizes both the right of individuals to protect their personal data and the need to process it for lawful purposes. Its provisions pursue these outcomes:

Processing rests on a lawful purpose, with consent or a defined legitimate use (Section 4).

Individuals can see, correct, erase and complain about the use of their data (Sections 11 to 13).

Data Fiduciaries keep personal data secure and report breaches (Section 8(5) and (6)).

Larger and riskier processors carry added audit and assessment duties (Section 10).

A Board enforces the Act through inquiry, directions and penalties (Sections 27 and 33).

Framework in Context

The Act is a Central Government statute administered by the Ministry of Electronics and Information Technology. Section 44(2) omits section 43A of the Information Technology Act, 2000 and clause (ob) of its section 87(2), and Section 44(3) replaces clause (j) of section 8(1) of the Right to Information Act, 2005. G.S.R. 843(E) brings Section 44(2) into force eighteen months after publication, so the provisions behind the Reasonable Security Practices and Procedures Rules, 2011 remain until then. G.S.R. 844(E) established the Data Protection Board of India on November 13, 2025.

Common Framework Mappings

Organizations map the Act to the frameworks below to reuse existing controls. The mappings are control-level aids, not equivalences: the Act uses its own terms (Data Fiduciary, Data Principal, certain legitimate uses), sets its own breach and rights clocks in the Rules, and restricts cross-border transfers by notification under Section 16.

Mapped frameworks include:

APEC Privacy Framework

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

EU General Data Protection Regulation (GDPR)

HIPAA (Health Insurance Portability and Accountability Act)

ISO/IEC 27701

NIST Privacy Framework

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data

UK General Data Protection Regulation (UK GDPR)