The DPDP Act 2023, explained properly.
India’s first standalone data protection statute, in plain language. Every chapter, all 44 sections, the Rules 2025 timetable, and what each duty actually asks you to do. Free to read, and deliberately thorough.
Who the Act binds, and what it reaches.
Section 3 sets the perimeter. Read it first, because everything else in the statute only matters once you know you are inside it.
Territorial reach
Applies to digital personal data processed within India. It also reaches processing outside India where that processing relates to offering goods or services to Data Principals in India.
Digital only
The Act covers personal data in digital form, and non-digital data that is subsequently digitised. Purely paper records that never get digitised sit outside it.
What is excluded
Personal data made publicly available by the Data Principal herself, or by anyone under a legal obligation to publish it, falls outside the Act. So does purely personal or domestic processing.
The terms you have to get right.
Get these five wrong and every downstream decision inherits the error. They are the vocabulary the whole Act is written in.
The individual the data is about. If you are reading this as a person rather than an organisation, this is you.
Whoever decides why and how personal data gets processed. The Act deliberately uses fiduciary rather than controller, importing a duty of trust.
Whoever processes on a Fiduciary’s behalf. Processors have no direct duties under the Act, which is why Section 8(2) makes the Fiduciary contractually responsible for them.
A registered intermediary through which a Data Principal can give, review and withdraw consent in one place. Rule 4 governs registration, and applies from 13 November 2026.
A Fiduciary the Government notifies as carrying higher risk. Section 10 then adds a DPO, an independent audit and an annual DPIA.
What a Data Fiduciary must actually do.
Sections 4 to 10 in the order the statute puts them. This is the operational core of the Act, and the part an auditor will test you against.
Grounds for processing personal data
Processing is lawful only on consent or a legitimate use. No other ground exists.
Notice
A clear, itemised notice must accompany or precede the consent request, in English or any Eighth Schedule language.
Consent
Consent must be free, specific, informed, unconditional, unambiguous, with clear affirmative action, and as easy to withdraw as to give.
Certain legitimate uses
Sets out the specific legitimate uses, including voluntary provision, State functions, medical emergency and employment purposes.
General obligations of Data Fiduciary
Accountability for processing by processors, data accuracy, security safeguards, breach handling, erasure and grievance redressal.
Processing of personal data of children
Verifiable parental consent required; no tracking, behavioural monitoring or targeted advertising directed at children.
Additional obligations of Significant Data Fiduciary
Appoint a DPO in India, appoint an independent data auditor, conduct periodic DPIAs and audits.
What a Data Principal can demand of you.
Five rights, each of which needs a working mechanism behind it rather than a mailbox nobody reads.
S. 11 · Right to access information about personal data
Data Principals may obtain a summary of personal data processed and the identities of recipients.
S. 12 · Right to correction and erasure of personal data
Right to correction, completion, updating and erasure of personal data.
S. 13 · Right of grievance redressal
Data Fiduciary must provide a readily available grievance mechanism and respond within a prescribed period.
S. 14 · Right to nominate
Data Principals may nominate another individual to exercise rights in the event of death or incapacity.
S. 15 · Duties of Data Principal
Data Principals must not impersonate, suppress information or register false grievances.
Children, and persons with a guardian.
A child under the Act is anyone under eighteen. That is a higher threshold than most comparable regimes, and it catches far more services than teams expect.
Verifiable consent
Before processing a child’s personal data you must obtain verifiable consent from a parent or lawful guardian. Rule 10 sets out how that verification has to work.
No tracking or targeting
Tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright. This is a flat ban, not a balancing test.
No detrimental processing
You must not undertake processing likely to cause any detrimental effect on the well-being of a child.
Significant Data Fiduciaries.
A second tier of duties for organisations whose failure would hurt the most. Assess the thresholds before you are notified, not after.
How you become one
The Central Government notifies a Data Fiduciary or a class of them, weighing the volume and sensitivity of personal data processed, risk to Data Principals, risk to electoral democracy, security of the State, and public order.
What changes
You must appoint a Data Protection Officer based in India who reports to the board, engage an independent data auditor, and complete an annual Data Protection Impact Assessment and audit.
Annual DPIA and audit, with results reported to the Board. Due diligence to verify that algorithmic software used for hosting, display, upload or sharing does not pose a risk to Data Principals. Plus restrictions on transferring specified personal data outside India.
For an SDF the DPO must be an individual, based in India, answerable to the board or its equivalent, and named as the point of contact for the grievance mechanism.
Breach notification, on two clocks.
There is no materiality threshold in the Act. Every personal data breach is notifiable, which makes triage discipline more important than judgement calls about severity.
Discover and contain
The clock starts on becoming aware. Without real monitoring under Rule 6(1)(c) you will not know, and the retention of logs for one year exists precisely so that you can reconstruct what happened.
Tell CERT-In within six hours
For incidents covered by the CERT-In directions under Section 70B of the IT Act. This clock is tighter than the DPDP one and runs in parallel.
Tell affected Data Principals without delay
In plain language, describing the nature and extent of the breach, the likely consequences, the mitigation measures taken, and what the individual can do to protect herself.
Notify the Board without delay
An initial intimation describing the breach, its nature, extent, timing and location.
File the detailed report within seventy-two hours
Including the events and circumstances leading to the breach, the remedial measures taken, and the findings on who caused it, together with a report on the intimations given to Data Principals.
The Rules, and when each one starts to bite.
Notified on 13 November 2025 with a tiered commencement in sub-rules 1(2), 1(3) and 1(4). The dates below are what actually determines your deadline.
| Rule | What it covers | In force from |
|---|---|---|
| 1 | Short title and commencement Tiered commencement. Rules 1, 2, 17 to 21 applied on notification (13 Nov 2025). Rule 4 applies from 13 Nov 2026. Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027. | 13 Nov 2025 |
| 3 | Notice given by Data Fiduciary The notice must be standalone, in clear plain language, itemising the personal data and purpose, and giving the withdrawal and grievance links. | 13 May 2027 |
| 4 | Registration and obligations of Consent Manager Consent Managers must register with the Board and meet stated conditions, including a net worth threshold. | 13 Nov 2026 |
| 5 | Processing for State and its instrumentalities Standards for processing for subsidy, benefit, service, certificate, licence or permit. | 13 May 2027 |
| 6 | Reasonable security safeguards Encryption, obfuscation, masking, access control, logging and monitoring, backups, and contractual obligations on processors. | 13 May 2027 |
| 7 | Intimation of personal data breach Affected Data Principals told without delay in plain language; the Board notified without delay; a detailed report filed with the Board within 72 hours. | 13 May 2027 |
| 8 | Erasure and time period for specified purposes Erasure once the purpose is no longer served. Schedule III sets a three-year limit for large e-commerce, online gaming and social media intermediaries, with 48 hours advance intimation to the Data Principal. | 13 May 2027 |
| 9 | Contact information of person able to answer questions Publish contact details of the DPO or person answering processing questions on the website and in every notice. | 13 May 2027 |
| 10 | Verifiable consent for children and persons with disability Verifiable parental or guardian consent, with due diligence on identity and age. | 13 May 2027 |
| 11 | Exemptions from certain obligations Exemptions for specified classes including healthcare and educational institutions for stated purposes. | 13 May 2027 |
| 12 | Additional obligations of Significant Data Fiduciary Annual DPIA and audit, algorithmic due diligence, and localisation of specified personal data. | 13 May 2027 |
| 13 | Rights of Data Principals Publish the means to exercise rights, the identifiers required, and the response timelines. | 13 May 2027 |
| 14 | Processing outside India Conditions on making personal data available to a foreign State or its instrumentality. | 13 May 2027 |
| 15 | Appointment, salary and terms of Board Chairperson and Members Board appointment machinery. | 13 May 2027 |
| 16-21 | Board procedure, digital office and appeals Complaint procedure, digital office functioning, and appeal process to the Appellate Tribunal. | 13 Nov 2025 |
| 22 | Schedule VII, calling for information The Government may call for information from a Data Fiduciary or intermediary. | 13 May 2027 |
What non-compliance costs.
Penalties are civil and are imposed by the Data Protection Board after an inquiry. They apply per contravention, not per programme.
| Up to | Contravention | Hook |
|---|---|---|
| Rs 250 crore | Failure to take reasonable security safeguards to prevent a personal data breach. | S. 8(5) |
| Rs 200 crore | Failure to notify the Board or affected Data Principals of a personal data breach. | S. 8(6) |
| Rs 200 crore | Breach of the additional obligations in relation to children. | S. 9 |
| Rs 150 crore | Breach of the additional obligations of a Significant Data Fiduciary. | S. 10 |
| Rs 10,000 | Breach of the duties of a Data Principal. | S. 15 |
| Rs 50 crore | Breach of any other provision of the Act or the Rules. | Residual |
The IT Act 2000 that still applies.
The DPDP Act did not repeal the IT Act. It removed one section and left the rest standing, so your obligations now sit across two statutes.
Omitted by Section 43 of the DPDP Act. Contracts and policies still citing it are now stale.
Reasonable security practices for sensitive personal data; sector contracts still reference them widely.
Criminal liability for capturing or transmitting images of a private area without consent.
Powers to direct interception, monitoring or decryption, with compliance duties on intermediaries.
Blocking directions, which interact with Section 37 of the DPDP Act.
Six-hour cyber incident reporting, 180-day log retention in India, and KYC obligations for specified service providers.
Criminal liability for disclosure of personal information in breach of a lawful contract.
Due diligence obligations under the IT Rules 2021 as a condition of safe harbour.
Every term the Act defines.
Statutory definitions, with the section each one comes from. Search it rather than scrolling.
Data Principal · S. 2(j)
The individual to whom the personal data relates. Where the individual is a child, it includes the parent or lawful guardian; where a person with disability, the lawful guardian.
Data Fiduciary · S. 2(i)
Any person who alone or in conjunction with others determines the purpose and means of processing personal data.
Data Processor · S. 2(k)
Any person who processes personal data on behalf of a Data Fiduciary.
Personal data · S. 2(t)
Any data about an individual who is identifiable by or in relation to such data.
Processing · S. 2(x)
A wholly or partly automated operation or set of operations performed on digital personal data.
Consent Manager · S. 2(g)
A person registered with the Board who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw consent.
Significant Data Fiduciary · S. 2(z)
A Data Fiduciary or class notified by the Central Government based on volume and sensitivity of data and the risks it carries.
Legitimate uses · S. 7
The grounds in Section 7 on which personal data may be processed without consent, including voluntary provision and State functions.
Personal data breach · S. 2(u)
Any unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability.
Data Protection Board · S. 18
The Data Protection Board of India, the adjudicating body established under Chapter V.
Gazette notification · S. 1(2)
The official publication through which the Act and the Rules are brought into force, in phases.
Certain legitimate uses · S. 7
Shorthand for Section 7 grounds, distinct from consent under Section 6. Each use must be documented.
Reading it is the easy part.
If you now want to know where your organisation actually stands, score yourself against 52 statutory obligations and take away a prioritised action plan. It runs in your browser and nothing is transmitted.