DPDP Act 2023 explained: a guide to the summary, rules, rights and penalties

The DPDP Act 2023 guide: what it is

The DPDP Act 2023 is the Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, which received assent on 11 August 2023. The dpdp full form is Digital Personal Data Protection, and the Act is often called simply the DPDP Act. Its long title describes a law to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such data for lawful purposes. It is the data protection law in India in the sense that it sets general rules for how organisations may collect and use personal data, and it creates a Data Protection Board to enforce them.

Anyone who asks what the dpdp full form says about the purpose of the Act will find the answer in that long title: protection of personal data on one side, lawful processing on the other. The DPDP Act 2023 is therefore both a rights law and a compliance law. Earlier, the Information Technology Act 2000 had only a few provisions on personal data, most notably section 43A on compensation for failure to protect data. The DPDP Act replaces that thin layer with a full framework built around consent, defined duties and a regulator. A short guide to the older Act is in the guide to the IT Act 2000.

Summary of the key terms in the DPDP Act, in the Act's own words

The Act uses a vocabulary of its own. The table gives the main terms in the form in which section 2 defines them, so that a reader can follow the rest of this guide.

The two terms to keep in mind are the Data Principal, the individual whose data it is, and the Data Fiduciary, the organisation that decides why and how the data is used. A company that uses a service provider to handle the data remains the Data Fiduciary, and the provider is a Data Processor acting for it.

Who and what the Act applies to

Section 3 sets out the reach of the Act. It applies to the processing of digital personal data within the territory of India where the data is collected in digital form, or collected in non-digital form and digitised afterwards. It also applies to processing outside India if that processing is in connection with any activity related to offering goods or services to Data Principals within India. The second rule means that a foreign website that sells to people in India falls within the Act.

Two kinds of data are excluded. The Act does not apply to personal data processed by an individual for a personal or domestic purpose. And it does not apply to personal data that is made or caused to be made publicly available by the Data Principal herself, or by another person who is under a legal obligation in India to make it public. The Act gives an example: an individual who publicly posts her own personal data while blogging on social media is outside it. That second exclusion is narrow and depends on who made the data public.

Consent and notice

Section 4 allows a person to process the personal data of a Data Principal only in accordance with the Act and for a lawful purpose, which means a purpose not expressly forbidden by law, and only with the Data Principal's consent or for certain legitimate uses. Section 5 requires that every request for consent be accompanied or preceded by a notice that informs the Data Principal of the personal data and the purpose for which it is to be processed, how she may exercise her rights, and how she may complain to the Board.

Section 6 says what consent must be: free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, signifying agreement to the processing of her personal data for the specified purpose and limited to such personal data as is necessary for that purpose. A consent that is bundled with unrelated terms, or that is presumed from silence, does not meet that standard. Section 7 lists the legitimate uses for which no consent is needed. The first is processing for the specified purpose for which the Data Principal has voluntarily provided her data and has not indicated that she does not consent, as when a customer gives a phone number to receive a receipt. The remaining uses include certain functions of the State.

What a Data Fiduciary must do

Section 8 contains the general obligations. A Data Fiduciary must protect personal data in its possession or under its control, including processing done on its behalf by a Data Processor, by taking reasonable security safeguards to prevent a personal data breach. In the event of a breach it must give the Board and each affected Data Principal intimation in the form and manner prescribed. It must also erase personal data when the Data Principal withdraws consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with a law.

These duties explain why the DPDP Act 2023 matters to every organisation that holds customer or employee data. The duty to take security safeguards, the duty to report breaches and the duty to erase data are the three whose breach carries the highest penalties. For a company, the practical task is to know what personal data it holds, why, for how long and who has access.

Children's data

Section 9 contains special rules, and the Act treats a child as an individual who has not completed the age of eighteen years. A Data Fiduciary must obtain verifiable consent of the parent, or of the lawful guardian in the case of a person with disability who has one, before processing the personal data of a child. It must not undertake processing that is likely to cause any detrimental effect on the well-being of a child, and it must not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. A breach of these obligations carries a penalty of up to Rs 200 crore.

Rights and duties of Data Principals

Chapter III gives individuals several rights. Under section 11 a Data Principal who has given consent may obtain a summary of the personal data being processed and the processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom the data has been shared. Under section 12 she has the right to correction, completion, updating and erasure of her personal data. Under section 13 she has the right to readily available means of grievance redressal from the Data Fiduciary or Consent Manager. Under section 14 she may nominate another individual to exercise her rights in the event of her death or incapacity.

The Act also places duties on the individual. Under section 15 a Data Principal must comply with applicable laws when exercising her rights, must not impersonate another person while providing personal data, must not suppress material information when providing data for an identity or address document issued by the State, must not register a false or frivolous grievance or complaint, and must furnish only information that is verifiably authentic when exercising a right to correction or erasure. A breach of these duties carries a penalty of up to Rs 10,000.

Significant Data Fiduciaries

Section 10 allows the Central Government to notify a Data Fiduciary, or a class of Data Fiduciaries, as a Significant Data Fiduciary on the basis of factors that include the volume and sensitivity of the personal data processed and the risk to the rights of Data Principals. Such a fiduciary has additional obligations, including the appointment of a Data Protection Officer. A breach of the additional obligations carries a maximum penalty of Rs 150 crore, which is the fourth tier of the Schedule after the security, breach-notice and children's provisions.

The Data Protection Board and the penalties

Section 18 provides for the Data Protection Board of India, to be established by the Central Government with effect from a date it notifies. The Board inquires into breaches and, under section 33, may impose the monetary penalty specified in the Schedule if it determines at the end of an inquiry that a breach is significant, after giving the person an opportunity to be heard. In deciding the amount it must regard the nature, gravity and duration of the breach, the type and nature of the personal data affected and other matters the section lists. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal, which is the Appellate Tribunal for the Act.

The amounts are maximums, and the penalty in a given case depends on the Board's assessment. The Schedule sets monetary penalties only, they are imposed by the Board, and a person aggrieved can appeal to the Appellate Tribunal.

Commencement and the DPDP Rules 2025

As a data protection law in India, the DPDP Act 2023 does not operate all at once. Section 1(2) provides that the Act comes into force on such date as the Central Government appoints by notification, and different dates may be appointed for different provisions. The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) in a Gazette notification dated 13 November 2025, and the Press Information Bureau, which gives 14 November 2025 as the date of notification, describes this as the full operationalisation of the Act. The DPDP Rules 2025 page summarises them. According to the Bureau, the Rules provide for an eighteen-month period of phased compliance, and require every Data Fiduciary to issue a separate consent notice that is clear and easy to understand and that explains the specific purpose for which personal data is collected and used.

Because the provisions come into force in stages, a reader who needs to know whether a particular obligation applies today should check the notifications for that provision and the text of the Rules. This guide describes the Act and the official summary of the Rules, and it does not substitute for the notified commencement dates.

Transfers abroad and the relation to the IT Act

Section 16 allows the Central Government to restrict by notification the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India that it notifies, and it says that nothing in the section restricts any Indian law that gives a higher degree of protection. Section 44 amends other laws. Under section 44(2)(a), section 43A of the Information Technology Act 2000 shall be omitted; this means that the compensation remedy against a body corporate for failure to protect data, described under cyber law notes, is to be replaced by the framework of the DPDP Act when that provision commences. Section 44(1) amends the Telecom Regulatory Authority of India Act so that the Appellate Tribunal under the DPDP Act is covered, which is why appeals lie to the same tribunal that hears appeals under the Information Technology Act.

For a person whose data has been misused through a crime such as identity theft, the criminal provisions of the Information Technology Act remain the route, and the way to report is set out in the guide on how to file a cyber crime complaint online. The statistics on such offences are under cyber crime in India.

Frequently asked questions