Digital Personal Data Protection Act, 2023
Key Provisions
The DPDP Act, 2023, enacted on 11 August 2023 with rules notified on 14 November 2025, is India's first comprehensive data protection legislation. While primarily aimed at regulating the processing of digital personal data by both government and private entities, its Section 44 amends three existing laws, including the RTI Act.
- Applies to digital personal data processed within India and to processing outside India if related to offering goods/services in India
- Key concepts: Data Principal (individual whose data it is), Data Fiduciary (entity processing data), Consent Manager (registered intermediary)
- Data Protection Board of India: Adjudicatory body (not a regulator) established under Section 18 — quasi-judicial, not fully independent
- Section 44(3): Amends RTI Act Section 8(1)(j) — removes the public interest override for personal information
- Section 44(2): Amends IT Act, 2000 — omits Section 43A (compensation for data breaches)
- Penalties: Up to Rs 250 crore for data breaches; up to Rs 200 crore for non-compliance with children's data provisions
- Exemptions: Government agencies exempted on grounds of sovereignty, security, public order (Section 17)
● Tracked since February 19, 2026 · last seen May 19, 2026 · updates as the daily brief publishes
15 Apr '26
‘Age tokens’ via DigiLocker to regulate kids’ social media use in Andhra Pradesh
Polity & Governance
12 Mar '26
Supreme Court to look into what constitutes ‘personal data’ in DPDP laws
Polity & Governance
Polity & Governance
Right to Privacy as a Fundamental Right
Polity & Governance
Right to Information Act, 2005
Polity & Governance
Centre-State Legislative Relations
International Relations
India AI Impact Summit 2026 and Global AI Governance
Science & Technology
Right to Privacy
Polity & Governance
Competition Commission of India (CCI)
See it in today’s brief.
Daily current affairs with every static concept explained in place.
Read the daily brief