The Digital Personal Data Protection Act, 2023 is India's dedicated law for protecting personal data. After years of drafts and debate, it gives individuals real rights over their data and places clear duties on the organisations that hold it. Here's the plain-English version.
What it is
The DPDP Act governs the processing of digital personal data — any data about an identifiable person that is handled digitally. It applies whether the data was collected online or collected on paper and later digitised.
The terms you need
- Personal data — data about an identifiable individual.
- Data Principal — the individual the data is about.
- Data Fiduciary — whoever decides why and how the data is processed.
- Consent — a free, specific, informed, unambiguous "yes" for a stated purpose, as easy to withdraw as to give.
What it requires, in a sentence
Tell people clearly what you're collecting and why, get their consent (or rely on a specific legitimate use), keep the data safe, use it only for that purpose, let people exercise their rights, and report breaches.
It is consent-centric
Unlike some laws, the DPDP Act leans heavily on consent and a short list of legitimate uses as the lawful bases for processing. That makes clean, itemised consent and clear notices the backbone of compliance.
Who enforces it
The Data Protection Board of India investigates complaints and can impose financial penalties — up to ₹250 crore for serious security failures.
Why it matters now
The Act and its Rules are being brought into force, and enforcement follows. The organisations that prepare early — mapping their data, fixing consent and standing up the required processes — will be ready; those that wait will scramble. If you hold people's personal data, the time to act is now.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.