What the Act covers
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive law on personal data. It governs the processing of digital personal data, meaning data about an identifiable individual that is collected in digital form, or collected offline and later digitised.
The Act applies to processing within India, and to processing outside India if it is connected with offering goods or services to individuals in India. Rules under the Act were notified in November 2025 with a phased timeline for different obligations, so businesses should check which requirements are already in force and which are coming.
Key roles under the Act
- Data Principal: the individual to whom the personal data relates. For children and certain persons with disabilities, this includes a parent or lawful guardian.
- Data Fiduciary: the person or business that decides the purpose and means of processing, typically the business collecting the data.
- Data Processor: a person who processes data on behalf of a Data Fiduciary, such as a cloud or payroll service provider.
- Significant Data Fiduciary: a Data Fiduciary notified by the government based on factors such as the volume and sensitivity of data processed, which has additional obligations.
- Consent Manager: a registered entity through which individuals can give, manage and withdraw consent.
Main obligations of a Data Fiduciary
- Lawful basis: process personal data only with valid consent or for certain legitimate uses specified in the Act.
- Notice: when seeking consent, give a clear notice describing the data, the purpose and how individuals can exercise their rights and complain.
- Valid consent: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give.
- Accuracy and security: take reasonable steps to keep data accurate and implement reasonable security safeguards to prevent breaches.
- Breach notification: inform the Data Protection Board of India and affected individuals of a personal data breach, in the manner prescribed.
- Retention: erase personal data once the purpose is served and consent is withdrawn, unless retention is required by law.
- Children's data: obtain verifiable parental consent before processing a child's data, and avoid tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions.
- Grievance redressal: publish contact details of a person who can answer questions about processing, and provide an effective grievance mechanism.
Rights of individuals
Data Principals have the right to obtain a summary of their personal data and processing, to seek correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise their rights in the event of death or incapacity. They also have duties, including not to register false or frivolous complaints.
Penalties
The Data Protection Board of India can impose monetary penalties for breaches of the Act. The schedule to the Act provides for penalties that can reach up to two hundred and fifty crore rupees for failure to take reasonable security safeguards to prevent a personal data breach, with other amounts specified for other breaches.
Practical steps to prepare
- Map your data: list what personal data you collect, where it comes from, where it is stored and who it is shared with.
- Review your notices and consent flows: update website forms, apps and privacy policies so that notices are clear and consent is properly recorded.
- Review contracts with processors: ensure vendors that handle personal data on your behalf are bound to appropriate safeguards.
- Set retention periods: decide how long each category of data is needed and build a process to delete it afterwards.
- Prepare for breaches: create an incident response plan, including who decides and how notifications will be made.
- Appoint a contact: designate a person to handle data queries and grievances, and publish their details.
- Train your team: make sure staff who handle personal data understand the basics.
This explainer is general information as of November 2026 and is not legal advice. It does not create an advocate-client relationship. Please seek advice on the specific facts of your matter.