Digital Personal Data Protection Act, 2023 (DPDPA)
The Digital Personal Data Protection Act, 2023 is India's comprehensive data protection legislation, enacted after nearly six years of deliberation following the Puttaswamy judgment. It establishes a consent-based framework for processing personal data.
- The DPDPA requires data fiduciaries (entities processing data) to obtain free, informed, specific, and unconditional consent from data principals (individuals).
- Section 6 mandates that consent must be as easy to withdraw as it was to give — directly addressing the WhatsApp-style "take-it-or-leave-it" consent model.
- Section 17(2)(b) allows the Central Government to exempt government instrumentalities from certain provisions on grounds of national security and public order — a contested provision.
- A Data Protection Board of India is to be constituted as the adjudicatory authority under the Act.
- As of early 2026, the DPDPA's rules had not been fully notified, leaving CCI as the primary enforcement mechanism for data-related competition concerns.
● Tracked since March 01, 2026 · last seen March 28, 2026 · updates as the daily brief publishes
See it in today’s brief.
Daily current affairs with every static concept explained in place.
Read the daily brief