Digital Personal Data Protection Act, 2023 (DPDP Act)
India's DPDP Act, enacted in August 2023 (No. 22 of 2023), is the country's first comprehensive data protection law. It replaced the limited data protection framework under the Information Technology Act, 2000 and sought to align India with global data protection standards.
- Scope: The Act covers all digital personal data (data about an identifiable individual) processed in India, and also data processed outside India if it involves offering goods/services to Indian residents.
- Data Fiduciaries (entities that determine the purpose and means of data processing) must obtain consent for processing, ensure data minimisation, maintain data accuracy, and implement security safeguards.
- Data Localisation: The DPDP Act does not impose blanket data localisation — instead, it empowers the government to notify cross-border data transfer restrictions to specific countries or territories. Sectoral regulators (RBI, SEBI, IRDAI) have separate data localisation requirements.
- Government Exemption: Section 17 of the Act allows the central government to exempt processing by government agencies for national security, public order, prevention of offences, or research/archiving — a broad exemption that critics argue creates surveillance loopholes.
- Data Protection Board: The Act establishes a Data Protection Board of India to hear complaints and adjudicate breaches — but the Board's independence has been questioned as members are appointed by the government.
● Tracked since March 03, 2026 · last seen June 22, 2026 · updates as the daily brief publishes
See it in today’s brief.
Daily current affairs with every static concept explained in place.
Read the daily brief