The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's law on processing digital personal data. Under section 3 it covers processing in India and offshore processing connected with offering goods or services to people in India. Its core obligations apply from 13 May 2027 under the DPDP Rules, 2025, with penalties of up to ₹250 crore per breach.
Key takeaways
- DPDP stands for Digital Personal Data Protection; the Act was published in the Gazette on 11 August 2023.
- It applies to any organisation, of any size, processing digital personal data in India or offering goods or services to people in India from abroad.
- There is no small-business exemption; the power to exempt startups under section 17(3) has not been used.
- You need consent or one of the legitimate uses in section 7; there is no 'legitimate interests' ground.
- Notice, consent, security, breach intimation, retention, rights and children's rules all apply from 13 May 2027.
Until now, the main statutory hook for personal data in India was section 43A of the Information Technology Act, a compensation provision with no dedicated data protection regulator behind it. The Digital Personal Data Protection Act, 2023 replaces that with a single, horizontal law that applies across sectors, backed by a dedicated regulator and penalties measured in hundreds of crores.
This guide is the starting point: what the Act is, whether it applies to you, who the key players are, what you must do, and where things stand on 13 November 2026. Each obligation links to a deeper guide.
What does DPDP stand for, and what does the Act do?
DPDP is short for Digital Personal Data Protection. The Act was published in the Gazette on 11 August 2023 as Act No. 22 of 2023. It is deliberately short: it sets out principles and obligations, and leaves the detail (how a notice must look, what security is "reasonable", how fast to report a breach) to rules. Those rules are the DPDP Rules, 2025, notified on 13 November 2025 as G.S.R. 846(E).
In one paragraph: an organisation that decides why and how personal data is processed (a Data Fiduciary) may process it only for a lawful purpose, on the basis of consent or a listed legitimate use. It must give a clear notice, keep the data secure, report every breach, erase data once the purpose is served, honour the individual's rights and handle grievances. Children's data needs verifiable parental consent. A Data Protection Board of India inquires into breaches and can impose penalties of up to ₹250 crore per breach.
Who does the DPDP Act apply to?
Section 3 sets the scope. The Act applies to the processing of digital personal data within India, whether the data was collected digitally or collected offline and digitised later. It also applies to processing outside India if that processing is connected with offering goods or services to Data Principals in India. A Singapore SaaS company selling to Indian users, or a US app with Indian customers, is covered for that processing.
Personal data means any data about an individual who is identifiable by or in relation to that data (section 2(t)). It does not matter whether you are a company, a firm, a trust, a sole proprietor or a government body: "person" in the Act includes the State.
What is excluded
- Personal data processed by an individual for a personal or domestic purpose.
- Personal data made publicly available by the Data Principal herself, or by someone under a legal obligation to publish it.
- Processing covered by the exemptions in section 17: for example enforcing legal rights, courts and regulators, prevention and investigation of offences, and non-residents' data processed in India under a foreign contract. Research, archiving and statistics that meet the Second Schedule standards (Rule 16) are outside the Act altogether.
No small-business exemption
There is no threshold based on turnover, headcount or number of users. A ten-person clinic and a listed bank face the same core obligations. Section 17(3) allows the government to exempt notified Data Fiduciaries, including startups, from section 5 (notice), sections 8(3) and 8(7) (accuracy and erasure), section 10 and section 11. That power has not been used, so plan on the full set of obligations.
Who are the key players?
The Act uses its own vocabulary. Getting the roles right matters because the obligations sit almost entirely on one of them.
- Data Principal: the individual the data is about. For a child (anyone under 18, section 2(f)) it includes the parent or lawful guardian, and for a person with disability, the lawful guardian (section 2(j)).
- Data Fiduciary: whoever determines the purpose and means of processing, alone or with others (section 2(i)). This is the GDPR "controller" equivalent and carries the obligations.
- Data Processor: processes on behalf of a fiduciary (section 2(k)). Processors have no direct obligations under the Act, but the fiduciary is responsible for what they do, whatever the contract says (section 8(1)). See data fiduciary vs data processor.
- Consent Manager: a company registered with the Board that lets people give, manage, review and withdraw consent through one interoperable platform (section 2(g)). See consent managers.
- Significant Data Fiduciary (SDF): a fiduciary the government notifies on the basis of volume and sensitivity of data and risk. SDFs carry extra duties (section 10). None has been notified yet.
- Data Protection Board of India: the adjudicating body that inquires into breaches and imposes penalties. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
When can you process personal data?
Section 4 allows processing only for a lawful purpose, and only on one of two grounds.
Consent (section 6) must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the purpose. People can withdraw it at any time, as easily as they gave it, and the burden of proving that notice was given and consent obtained sits with you (section 6(10)).
Legitimate uses (section 7) are a closed list. They cover data a person voluntarily provides for a specified purpose without objecting, State benefits and functions, legal obligations, court orders, medical emergencies, epidemics, disasters and breakdowns of public order, and employment purposes. There is no open-ended "legitimate interests" ground of the GDPR kind, so analytics, marketing and product improvement usually need consent. Our consent and legitimate uses guide works through each one.
What are the obligations at a glance?
All of the obligations below apply from 13 May 2027. The table maps each one to the section, the Rule that fills in the detail, and the guide that explains how to implement it.
| Obligation | Act | Rules | What it means in practice |
|---|---|---|---|
| Notice | s.5 | Rule 3 | Standalone, plain-language notice with an itemised list of data and specific purposes, in English or any Eighth Schedule language |
| Consent and legitimate uses | s.4, 6, 7 | Rule 4 (consent managers) | A valid ground for every purpose, withdrawal as easy as giving consent, proof of both |
| Security safeguards | s.8(4), 8(5) | Rule 6 | Encryption or masking, access control, logging and monitoring, backups, one-year log retention, processor contracts |
| Breach intimation | s.8(6) | Rule 7 | Tell the Board and every affected person about every breach, with a detailed Board report within 72 hours |
| Retention and erasure | s.8(7), 8(8) | Rule 8 | Erase when the purpose is served or consent is withdrawn; keep logs for at least one year |
| Rights and grievances | s.8(10), 11 to 14 | Rules 9, 14 | Access, correction, erasure, nomination; a published grievance period of no more than 90 days |
| Children and persons with disability | s.9 | Rules 10 to 12 | Verifiable consent of a parent or guardian; no tracking, behavioural monitoring or targeted ads at children |
| SDF duties | s.10 | Rule 13 | India-based DPO, independent data auditor, annual DPIA and audit |
| Cross-border transfers | s.16 | Rule 15 | Allowed unless the government restricts a country; none restricted so far |
Alongside these, every fiduciary must keep data complete, accurate and consistent where it is used for a decision or shared (section 8(3)), use processors only under a valid contract (section 8(2)), and publish the business contact of a DPO or another person who can answer questions about processing (section 8(9), Rule 9).
Rights and duties of individuals
Data Principals can ask for a summary of their data and processing, and the identities of others it was shared with (section 11); have it corrected, completed, updated or erased (section 12); have grievances redressed (section 13), which they must use before approaching the Board; and nominate someone to act for them on death or incapacity (section 14). Unusually, the Act also gives individuals duties under section 15: no impersonation, no suppressing material information, no false or frivolous complaints. Breaching those duties carries a penalty of up to ₹10,000.
How is the Act enforced?
Once its Members are appointed, the Data Protection Board of India acts on a breach intimation, a complaint from a Data Principal, a reference from government or a court direction. It works as a digital office with the powers of a civil court, and must complete an inquiry within six months, extendable by three months at a time (Rule 19). It can accept a voluntary undertaking at any stage (section 32), and if it finds a significant breach, it imposes a penalty after a hearing (section 33).
The Schedule to the Act sets the maximum per breach: ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to report a breach, ₹200 crore for children's obligations, ₹150 crore for SDF obligations and ₹50 crore for anything else. Penalties go to the Consolidated Fund of India; individuals get no compensation under the Act. Appeals lie to TDSAT within 60 days and then to the Supreme Court. The full picture, including the blocking power in section 37, is in our DPDP penalties guide.
Where do things stand today?
The Act and the Rules were notified on 13 November 2025 with a phased start. As of 13 November 2026:
- In force since 13 November 2025: definitions, the Board provisions and Rules 1, 2 and 17 to 21. The Board is established, but its Chairperson and Members have not been appointed. MeitY invited applications on 6 May 2026.
- In force from today, 13 November 2026: consent manager registration (section 6(9) and Rule 4). No consent manager has been registered yet.
- From 13 May 2027: everything else, including notice, consent, security, breach intimation, retention, rights, children's data and penalties.
A proposal to shorten the 18-month window to 12 months was discussed with industry in early 2026 but has not been adopted, so 13 May 2027 stands. No SDF, restricted country or startup exemption has been notified. Writ petitions challenging parts of the Act and Rules are pending before the Supreme Court, with no stay. The enforcement date guide tracks every date in one place.
What to do next
Six months is not long for a programme that touches product, engineering, security, HR and vendor contracts. A practical sequence:
- Confirm scope. Run the decision flow above for each business line and record whether you act as fiduciary or processor.
- Map your data. List what personal data you collect, why, where it sits, who you share it with and how long you keep it.
- Fix the ground for each purpose. Consent or a section 7 legitimate use; anything relying on "legitimate interests" elsewhere needs a new basis.
- Close the gaps in notice, consent capture, security logging, breach response, retention and rights handling, using the DPDP compliance checklist.
- Sequence the work against 13 May 2027 with the implementation roadmap.
If you want an engineering and security team to do the implementation alongside your legal counsel, see our services.
Frequently asked questions
What is the full form of DPDP?
DPDP stands for Digital Personal Data Protection. The law is the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), and the rules made under it are the Digital Personal Data Protection Rules, 2025, notified as G.S.R. 846(E) on 13 November 2025.
Is the DPDP Act applicable to small businesses and startups?
Yes. The Act has no general exemption based on size or turnover. Section 17(3) lets the Central Government exempt notified Data Fiduciaries, including startups, from some obligations, but no such notification has been issued so far.
Does the DPDP Act apply to companies outside India?
Yes, if the processing is connected with offering goods or services to Data Principals in India (section 3). Unlike the GDPR, there is no separate trigger for monitoring behaviour; the link is to offering goods or services.
Does the DPDP Act cover paper records?
It covers digital personal data, including data collected on paper and later digitised. Records that stay purely on paper and are never digitised fall outside section 3.
Is the DPDP Act in force now?
Partly. The Board provisions and definitions have been in force since 13 November 2025 and consent manager registration since 13 November 2026. The core obligations on businesses apply from 13 May 2027.
Does the DPDP Act apply to employee data?
Yes. Employee data is personal data. Section 7(i) gives a legitimate use for employment purposes and for protecting the employer from loss or liability, so you may not need consent for every HR process, but the other obligations such as security and breach intimation still apply.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.