The Digital Personal Data Protection Act, 2023
Every obligation traced to its section, every answer carrying its citation. Built for the people who have to act on the law, not only read it.
Start where you are
You need to know what applies to you and what it costs to get wrong.
Start with what counts as personal data in your businessYou need the text, its amendments, and what supersedes what.
Read the Act with its rules and gazette historyYou need consent and notice that hold up in a real user flow.
See what a compliant notice has to containYou need retention, access control, and breach handling in code.
Review the technical obligations by sectionReference
The full text of the DPDP Act 2023, section by section, with the 2025 Rules alongside.
Data Principal, Data Fiduciary, Significant Data Fiduciary, Consent Manager — who each term binds.
What a Data Fiduciary must do: notice, consent, purpose limitation, retention, security safeguards.
Access, correction, erasure, grievance redressal, and nomination — and the timelines attached.
Consent notices, retention schedules, DSAR workflows, and a processing register you can adapt.
What to do in the first 72 hours, who to notify, and what the Board expects on record.
Readiness
Five questions, each tied to a specific obligation. Nothing is stored unless you ask for the result.
Do you know every place personal data enters your business?
Section 4 — grounds for processing
Does your consent notice state the purpose in plain language?
Section 5 — notice
Do you delete personal data once its purpose is served?
Section 8(7) — erasure
Can a Data Principal reach you to access or correct their data?
Sections 11–13 — rights
Do you have a written breach response plan?
Section 8(6) — breach intimation
Common questions
It applies to anyone processing digital personal data in India, and to processing outside India where goods or services are offered to people in India. It does not cover personal data processed for a purely personal or domestic purpose, or data made publicly available by the person themselves or under a legal obligation.
Failing to take reasonable security safeguards carries a penalty of up to ₹250 crore. Failing to notify the Data Protection Board or affected Data Principals of a breach carries up to ₹200 crore. Penalties are set by the Board after an inquiry, weighing the nature, gravity, and duration of the breach.
It must describe the personal data being sought, the purpose of processing, how a Data Principal may exercise their rights, and how to complain to the Board. It must be standalone, itemised, and written in plain language, and be available in English or any of the 22 languages in the Eighth Schedule.
A class the Central Government may notify based on the volume and sensitivity of data processed, risk to Data Principals, and impact on sovereignty, electoral democracy, and public order. Additional obligations follow: appointing a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments.
Anyone under 18 is a child. Verifiable consent from a parent or lawful guardian is required before processing. Tracking, behavioural monitoring, and targeted advertising directed at children are prohibited, though the Government may exempt certain classes of Data Fiduciary.
The Act received assent in August 2023 and is being brought into force in stages through notification. The Rules published in 2025 set out the operational detail — consent manager registration, breach intimation, and verifiable consent for children. Check the changes feed for the current commencement position.
Only Significant Data Fiduciaries must appoint a Data Protection Officer, who has to be based in India and answerable to the board of directors or equivalent. Every Data Fiduciary must nevertheless publish the contact details of someone able to answer questions about processing.
A Data Principal can obtain a summary of the personal data being processed and the identities of others it has been shared with, ask for correction or erasure, nominate someone to act on their behalf in the event of death or incapacity, and use a grievance redressal route before approaching the Board.
A working checklist covering notice, consent, retention, rights, and breach response. No sales sequence — you can unsubscribe from the first email.
One email with the checklist. Regulatory updates only if you ask for them.