DPDP Act 2023: India's Digital Personal Data Protection Law

Section 1 doesn't create any obligation for anyone — it names the Act and hands the Central Government the power to switch different parts of it on at different times, by notification.

Section 2 is the Act's dictionary — 28 defined terms, from "automated" to "State," that every other section relies on.

Section 3 draws the outer boundary of the entire Act: what kind of data it covers, whose processing it reaches even outside India, and three specific situations it carves out entirely — personal or domestic use, and data the individual (or someone legally required to) has already made public.

Section 4 opens Chapter II with the Act's most fundamental rule: you may only process someone's personal data if you have a lawful basis to do so, and the Act recognises exactly two — the person's consent, or one of the specific "certain legitimate uses" listed in Section 7.

Section 5 requires that consent never be collected blind: every consent request must come with a notice telling the Data Principal what data is being collected, why, how to exercise their rights, and how to complain.

Section 6 is the Act's longest and most detailed provision on what makes consent actually valid — free, specific, informed, unconditional and unambiguous — how withdrawal works, and how Consent Managers fit into the picture.

Section 7 is the Act's second lawful basis for processing — a closed list of nine specific situations where personal data can be processed without collecting fresh consent, from voluntarily provided data to medical emergencies, disasters and employment-related purposes.

Section 8 is the operational core of the entire Act for most businesses: accuracy, security safeguards, breach intimation, erasure timelines, published contact information, and grievance redressal, all in one section.

Section 9 sets a strict default for anyone under eighteen: verifiable parental consent before processing, an outright ban on tracking, behavioural monitoring and targeted advertising directed at children, and a path for the Central Government to relax these rules for specific, verifiably safe use cases.

Section 10 closes out Chapter II with a heavier compliance tier reserved for organisations the government formally designates as Significant Data Fiduciaries — an India-based Data Protection Officer, an independent data auditor, and ongoing impact assessments and audits.

Section 11 opens Chapter III's rights with the most foundational one: the right to actually find out what a Data Fiduciary is doing with your personal data, and who else it's been shared with.

Section 12 gives Data Principals a direct lever over their own data quality and lifespan: the right to have inaccurate data corrected, incomplete data completed, and data erased once it's no longer needed.

Section 13 requires every Data Fiduciary and Consent Manager to run a working, responsive grievance process — and makes using it a required first step before a Data Principal can take a complaint to the Board.

Section 14 is a short but distinctive right: letting a Data Principal name someone else in advance to exercise their data rights if they die or become incapacitated — a kind of digital-data succession planning built directly into the Act.

Section 15 closes Chapter III with a short but important reminder: the Act's rights framework runs in both directions.

Section 16 gives the Central Government a targeted tool to restrict cross-border data transfers to specific countries or territories, while making clear it doesn't override stricter transfer rules that already exist in other Indian laws.

Section 17 is where the Act carves out entire categories of processing from most of Chapter II and III's obligations — legal enforcement, courts and tribunals, crime prevention, cross-border contracts, corporate restructuring, research, national security, and small or early-stage businesses like startups.

Section 18 creates the Data Protection Board of India as a legal body corporate — the Act's central regulator and adjudicator, and the section that brought the Board itself into existence on 13 November 2025.

Section 19 sets out who sits on the Board and what qualifies them — a Chairperson and Members appointed by the Central Government, chosen for ability, integrity and relevant expertise, with at least one required to be a legal expert.

Section 20 protects the Board's independence in a simple, practical way: fixing that a Chairperson or Member's pay can't be cut after their appointment, and giving them a defined, renewable two-year term.

Section 21 sets the specific grounds that disqualify someone from becoming, or continuing as, Chairperson or a Member — insolvency, moral-turpitude convictions, incapacity, conflicts of interest, and abuse of position — and guarantees a hearing before removal.

Section 22 covers how a Chairperson or Member can resign, how a resulting vacancy gets filled, and a one-year cooling-off restriction on accepting employment after leaving office — a safeguard against a Member's decisions being influenced by future job prospects.

Section 23 sets how the Board conducts its own meetings and authenticates its orders, and includes a practical safety net: minor procedural defects or vacancies don't automatically invalidate what the Board has already done.

Section 24 gives the Board a short, practical staffing power: it can hire the officers and employees it needs, subject to the Central Government's prior approval.

Section 25 is a single, dense sentence with real legal consequences: everyone connected to the Board — Chairperson, Members, officers and employees — is treated as a public servant under the Indian Penal Code whenever acting under the Act, exposing them to specific criminal-law protections and liabilities.

Section 26 closes out the Board's constitutional and administrative provisions by defining exactly what powers the Chairperson personally holds — general administrative superintendence, the ability to delegate scrutiny of incoming matters, and the ability to allocate proceedings among Members.

Section 27 is where the Board's enforcement authority actually gets switched on: five specific triggers — breach intimations, Data Principal complaints, Consent Manager breaches, and government references — each giving the Board power to inquire and impose penalties, plus a general power to issue binding directions.

Section 28 is the Board's own rulebook for how an inquiry actually runs, from the first intimation through to closure or referral for penalty — digital-first process, civil-court-equivalent investigative powers, and specific protections against overreach and against false complaints.

Section 29 gives anyone unhappy with a Board order or direction a defined route to appeal — to the Appellate Tribunal (the Telecom Disputes Settlement and Appellate Tribunal), within 60 days, with a target of resolving appeals within six months.

Section 30 gives Appellate Tribunal orders real enforcement power — treating them as executable exactly like a civil court's own decree, with the option to route execution through a local civil court.

Section 31 gives the Board a short but useful option: where it thinks a complaint could be resolved through mediation rather than a full inquiry, it can direct the parties toward that route instead.

Section 32 gives a person facing a Board proceeding a way to proactively commit to specific corrective action, and have the Board accept that commitment as a bar to further proceedings on the same matter — unless the commitment itself is later broken.

Section 33 is where a Board inquiry can end in real financial consequence — monetary penalties up to the ceilings set in the Act's own Schedule, determined only after a hearing and only by weighing seven specific factors, from the breach's gravity to its actual deterrent impact on the person penalised.

Section 34 is a single, simple sentence: every rupee the Board collects in penalties goes to the Consolidated Fund of India, not to the Board itself or to any complainant.

Section 35 shields the Central Government, the Board and its people from legal proceedings over anything they did, or intended to do, in good faith under the Act or its rules.

Section 36 gives the Central Government a broad, standing power to demand information from the Board and from any Data Fiduciary or intermediary, for the Act's purposes.

Section 37 is the Act's most consequential public-interest power: after a Board reference showing repeated penalties against a Data Fiduciary, the Central Government can, after hearing that Fiduciary, order any intermediary to block public access to the information tied to its goods or services.

Section 38 answers a question that comes up constantly in practice: what happens when the DPDP Act and some other Indian law seem to say different things?

Section 39 keeps civil courts out of matters the Board is specifically empowered to handle under the Act, and stops courts from granting injunctions over action taken or to be taken under the Act.

Section 40 is the legal source of the entire DPDP Rules, 2025 — the power letting the Central Government fill in the operational detail the Act itself leaves to be "prescribed," across 26 specific listed matters.

Section 41 gives Parliament a check on the Central Government's rule-making and notification powers — every rule and certain notifications must be laid before both Houses, which can modify or annul them within a 30-day window.

Section 42 lets the Central Government update the Act's penalty Schedule by notification rather than needing a fresh Act of Parliament — but caps how far penalties can be increased, at double the amount originally enacted.

Section 43 is a standard safety-valve clause: if putting the Act into effect runs into a genuine difficulty, the Central Government can issue an order to fix it — but only within five years of commencement, and always subject to Parliament seeing the order afterward.

Section 44 closes out the Act with three consequential amendments to existing laws — the Telecom Regulatory Authority of India Act, the Information Technology Act, and the Right to Information Act — needed to make the rest of the Act's machinery actually fit into India's existing legal framework.