Digital Personal Data Protection (DPDP) Act, 2023

The Digital Personal Data Protection Act, 2023 is India's first full law to protect people's personal data in digital form. Personal data means any information that can identify you: your name, phone number, Aadhaar number, bank details, location or photos. The law tells companies and the government how they may collect and use such data, and it gives you rights over your own data. If a company misuses your data or fails to protect it, it can be fined up to Rs 250 crore.

Why does it exist?

Today almost every app, bank, shop and government office collects our data. Without clear rules, this data can be sold, leaked or used to cheat people. Data leaks can lead to fraud, spam calls and identity theft. India's earlier rules, under the Information Technology Act, 2000 and the SPDI Rules, 2011, were narrow and weak. A clear law was also needed because the Supreme Court declared privacy a fundamental right.

Where did it come from?

• In August 2017, a nine-judge bench of the Supreme Court, in Justice K.S. Puttaswamy (Retd.) v. Union of India, declared that the right to privacy is a fundamental right, part of the right to life and personal liberty under Article 21.
• In 2017, the government set up an expert committee under Justice B.N. Srikrishna to suggest a data protection law. It submitted its report and a draft bill in 2018.
• The Personal Data Protection Bill, 2019 was introduced and sent to a Joint Parliamentary Committee. The government withdrew it in August 2022, saying a simpler, comprehensive law would come.
• A fresh draft came in November 2022. The new bill passed the Lok Sabha on 7 August 2023 and the Rajya Sabha on 9 August 2023, and received the President's assent on 11 August 2023.
• The DPDP Rules, 2025 were notified in November 2025, with the law coming into force in phases over 18 months.

Who is who under the law?

• Data Principal: the person whose data it is (you). For a child or a person with a disability, the parent or lawful guardian acts for them.
• Data Fiduciary: the company or body that decides why and how your data is used, such as a bank or an app.
• Data Processor: a company that processes data on behalf of a Data Fiduciary, such as a cloud service.
• Significant Data Fiduciary (SDF): a large or sensitive Data Fiduciary that the government notifies, based on factors like the volume and sensitivity of data. It has extra duties: it must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out a Data Protection Impact Assessment from time to time.
• Consent Manager: a body registered with the Data Protection Board that lets you give, manage, review and withdraw consent through one easy platform.
• Data Protection Board of India: the body that hears complaints, investigates breaches and imposes penalties.

How does it work?

1. A Data Fiduciary may use your data only for a lawful purpose, and only with your consent or for certain "legitimate uses" listed in Section 7 (for example, when you share data yourself for a specific purpose, for government benefits, for medical emergencies, or for employment).
2. Before asking for consent, it must give you a notice in clear language, saying what data it wants and why. The notice must be available in English or any of the 22 languages in the Eighth Schedule.
3. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear "yes". You can withdraw it as easily as you gave it.
4. The fiduciary must keep the data accurate, protect it with reasonable security safeguards, report any data breach to the Board and to affected people, and erase the data once the purpose is over.
5. If you have a complaint, you first go to the company's grievance system, then to the Data Protection Board. Appeals against the Board go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Your rights and duties as a Data Principal

• Right to access information about your data and who it was shared with
• Right to correction and erasure of your data
• Right to grievance redressal
• Right to nominate someone to use your rights after your death or if you cannot act
• Duties too: you must not file false or frivolous complaints or give false details. Breaking a duty can attract a penalty of up to Rs 10,000.

Other key provisions

• Children (Section 9): A child is anyone below 18 years. Companies need verifiable consent of a parent to process a child's data, and must not do tracking, behavioural monitoring or targeted advertising aimed at children.
• Data outside India (Section 16): Data can be sent abroad freely, except to countries the government restricts by notification (a "negative list" approach).
• Exemptions (Section 17): The government can exempt its agencies from the law on grounds like sovereignty and integrity of India, security of the State, friendly relations with foreign States and public order.
• Penalties (Schedule): up to Rs 250 crore for failing to take reasonable security safeguards against a data breach; up to Rs 200 crore for not reporting a breach, and for breaking the rules on children's data; up to Rs 150 crore for breaking the extra duties of a Significant Data Fiduciary.
• Data Protection Board (Section 18): set up by the Central Government, with a Chairperson and members appointed for two years (they can be reappointed). It works as a digital office: complaints and hearings happen online.
• How Board members are chosen (Rule 17 of the DPDP Rules, 2025): A Search-cum-Selection Committee (a panel that finds and recommends suitable people) suggests names. For the Chairperson, the panel is headed by the Cabinet Secretary. It also has the Law Secretary (Department of Legal Affairs), the Secretary of the Ministry of Electronics and IT (MeitY) and two experts. For the other members, a similar panel is headed by the MeitY Secretary. The Central Government then makes the appointment.
• RTI change (Section 44(3)): The Act amended Section 8(1)(j) of the RTI Act, 2005, so that personal information is now exempt from disclosure under RTI without the earlier "larger public interest" test.

How is it being brought into force?

The DPDP Rules, 2025 were notified on 13 November 2025 in three phases:

• Immediately: the Data Protection Board and its procedures
• After one year (November 2026): the registration and duties of Consent Managers
• After 18 months (May 2027): most duties of Data Fiduciaries, such as notice, consent, security, breach reporting, children's data and SDF duties

Commonly confused concepts

• DPDP Act vs IT Act, 2000: The IT Act deals with cyber crimes, electronic records and digital signatures. The DPDP Act deals only with personal data protection.
• Right to privacy vs data protection: Privacy is the fundamental right (Article 21, Puttaswamy). Data protection is one law that puts this right into practice for digital data.
• India's DPDP Act vs the EU's GDPR: Both are consent-based. But the DPDP Act covers only digital personal data (and offline data that is later digitised), does not create a separate category of "sensitive personal data", and lets data flow abroad freely except to notified countries.
• Consent Manager (DPDP) vs Account Aggregator (RBI): Both help you manage consent. AAs work only for financial data and are licensed by the RBI. Consent Managers are registered with the Data Protection Board and can cover all kinds of data.

Issues, criticism and the way forward

• Wide government exemptions: Critics say Section 17 lets the government exempt its own agencies without clear limits or time bounds, which may not meet the Puttaswamy test of proportionality. The government's position is that exemptions are needed for national security and public order.
• RTI dilution: Transparency activists argue that Section 44(3) weakens the RTI Act by removing the public-interest test. Petitions on this are before the Supreme Court.
• Board independence: Members are appointed by the Central Government for short two-year terms, which critics say may limit the Board's independence. Both selection panels are also headed by government officers.
• A Board that is not yet working: Without a working Board, nobody can hear complaints or punish misuse of data, so the law cannot really protect anyone. As of October 2026, the Centre told the Kerala High Court that the Board had been constituted but was not yet functional. The court directed that it be made functional within eight weeks. This came in C.R. Neelakandan v. Union of India, a public interest case about passengers' data in Digi Yatra, the face-scan entry system at airports.
• Compliance burden: Small businesses and startups worry about the cost of building consent and security systems.
• Way forward: Experts suggest clearer limits on exemptions, longer and more independent Board terms, strong awareness campaigns, and simple tools so that ordinary users can actually use their rights.

Concepts to Know

• Personal data: Any data about a person who can be identified by or through that data.
• Data breach: Any unauthorised access, leak, change, loss or destruction of personal data.
• Data minimisation: Collecting only as much data as is really needed for the stated purpose.
• Purpose limitation: Using data only for the purpose for which it was collected.
• Proportionality test: A rule from the Puttaswamy case that any limit on privacy must have a legal basis, a legitimate aim, be necessary, and not go beyond what is needed.
• TDSAT: Telecom Disputes Settlement and Appellate Tribunal, a tribunal that also hears appeals against the Data Protection Board.