DPDP Act, 2023
The Digital Personal Data Protection Act, 2023, India’s main law on the processing of digital personal data.
The DPDP Act, 2023 is India's first dedicated law on personal data held in digital form. It tells organisations how they may collect and use your data, and it tells you what you can ask them to do about it.
Meaning of DPDP Act, 2023
The Act received the President's assent in August 2023. It sets out rights and duties of Data Principals, obligations of Data Fiduciaries, the Data Protection Board, penalties and exemptions. It has 44 sections and a Schedule of penalties. It is brought into force in stages by notification.
The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) is deliberately short compared with laws such as the EU's GDPR. The Act states the principles and the headline duties; the working detail (what a notice must contain, how a breach is reported, how a Consent Manager registers) is left to rules made under Section 40. That is why the Act should always be read together with the DPDP Rules, 2025.
Section 3 fixes the scope. The Act covers digital personal data processed in India, whether the data was collected digitally or collected on paper and digitised later. It also reaches processing outside India when that processing is connected to offering goods or services to people in India. It does not apply to purely personal or domestic use by an individual, or to personal data that the Data Principal herself made public, or that someone made public because a law required it. There is a single category of "personal data": unlike the old SPDI Rules 2011, the Act has no separate "sensitive" tier.
The body of the Act follows the life of a piece of data. Section 4 says personal data may be processed only for a lawful purpose, either with consent or for a listed "legitimate use". Section 5 requires a notice, Section 6 sets the standard for consent, and Section 7 lists the legitimate uses. Sections 8 to 10 set out the general duties of a Data Fiduciary, the special rules for children, and the extra duties of a Significant Data Fiduciary. Sections 11 to 15 give rights to the Data Principal (and one duty). Sections 16 and 17 deal with transfers abroad and exemptions.
The remaining sections build the enforcement machinery: the Data Protection Board of India (Sections 18 to 28), appeal to the Appellate Tribunal (Section 29), mediation (Section 31), voluntary undertakings (Section 32) and penalties (Sections 33 and 34). Section 38 says the Act adds to other laws and prevails where there is a true conflict, and Section 39 bars civil courts from deciding matters the Board can decide. Note what the Act does not do: it does not give individuals a right to compensation from the Board, and it has no general "legitimate interest" ground of the GDPR kind.
Examples of DPDP Act, 2023
A company reads Section 8 of the DPDP Act to learn its duties on security and breach intimation.
A mid-sized online retailer reads Section 8 and finds duties on accuracy, security, breach intimation and erasure. It then lists which of its systems hold customer addresses and order histories, and adds a retention rule for dormant accounts so the erasure duty can actually be met.
A hospital group had been following the SPDI Rules for "sensitive" health records. After reading the Act it realises that every patient identifier, not only diagnoses, is now personal data, so it extends access controls and logging to registration and billing systems as well.
The HR team of a software services firm checks whether employee data needs consent. Section 7(i) allows processing for purposes of employment and related safeguarding, so payroll and attendance rest on that ground, while an optional wellness programme is handled through a separate consent request.
Why DPDP Act, 2023 matters
The Act turns privacy from a principle into a compliance obligation with a price tag. The Schedule sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach, and the Board can impose them after an inquiry. Since the Supreme Court held in Puttaswamy (2017) that privacy is a fundamental right under Article 21, this Act is the statute through which that right is actually enforced against private organisations.
For individuals, the Act creates enforceable routes for the first time: a right to a summary of data and to correction and erasure, a right to grievance redressal, and the right to complain to the Board if the organisation does not respond. For organisations, consent records, retention schedules, vendor contracts and breach plans move from good practice to evidence that may be examined in an inquiry. Most of the duties apply from 13 May 2027, so the planning window is now.
How it works in practice
- 1Read the Act in the order data flows: Sections 4 to 7 (why you may process), Section 8 (how you must behave while holding it), Sections 11 to 14 (what individuals can ask) and Section 33 with the Schedule (what happens if you fail). Mark each section against the team that owns it.
- 2Pair every section you rely on with its Rule. For example, read Section 8(5) with Rule 6 on security safeguards, and Section 8(6) with Rule 7 on breach intimation, so that you work from the full operational standard and not only the headline text.
- 3Build a data inventory that identifies what personal data you hold, in which system, for which purpose, and who the processors are. Section 8(1) makes you responsible even for processing done on your behalf, so the inventory must include vendors.
- 4Check each sector law that applies to you (RBI, SEBI, IRDAI, NMC and others). Section 38 means you must meet both the Act and the sector rule, and the Act prevails only where the two truly conflict.
- 5Track notifications. Commencement dates, Significant Data Fiduciary designations, country restrictions under Section 16 and any exemption for notified classes all arrive by notification, so assign one person to watch the Gazette and Board announcements.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the Act as a copy of the GDPR. India has no legitimate-interest ground and no "sensitive data" category, so GDPR-style legal-basis tables must be rebuilt around consent and the Section 7 uses.
Reading only the Act and ignoring the Rules. Many of the practical requirements, such as the 72-hour detailed breach report, appear only in the Rules.
Assuming the Act applies only to technology companies. Any person processing digital personal data, including a clinic, a school or a manufacturer's HR team, is a Data Fiduciary unless an exemption applies.
Waiting for 13 May 2027 to begin. Consent re-papering, vendor contract changes and retention clean-up take many months in a company of any size.
Compliance tips
Keep a one-page map from each section of the Act to the internal owner and the evidence you will show if asked, so responsibility is never vague.
Use the Act's own words for the purposes in your notices and policies; if the policy language drifts from the statute, audits become harder.
Run a short annual refresher for staff who handle personal data, and record attendance, since training records support the "reasonable safeguards" narrative.
Treat this page as general information, not legal advice, and take advice from a qualified lawyer on how the Act applies to your facts.
Common questions about DPDP Act, 2023
Is the DPDP Act the same as the GDPR?
No. Both protect personal data, but the DPDP Act is shorter, has no legitimate-interest ground, has no separate sensitive-data category, covers only digital or digitised data, and does not give individuals compensation through the Board. Terms also differ: Data Fiduciary and Data Principal replace controller and data subject.
Does the DPDP Act apply to paper records?
Not directly. It covers digital personal data, including data collected on paper that is later digitised. A register that stays on paper and is never digitised falls outside it, though other laws and good practice still apply.
Is the DPDP Act already in force?
In stages. The provisions on the Board, definitions and rule-making started on notification in November 2025, the Consent Manager framework follows in November 2026, and the main duties on notice, consent, security and breach apply from 13 May 2027.
Does the Act replace Section 43A of the IT Act?
Yes. Section 44(2) of the Act omits Section 43A of the Information Technology Act, 2000, so the older compensation scheme for failure to protect sensitive personal data gives way as the DPDP framework takes effect.