The DPDP Act, 2023 explained: a plain-English guide for Indian businesses
Who India's Digital Personal Data Protection Act applies to, the roles and terms it introduces, the core obligations and the phased timeline under the 2025 Rules.
India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") is the country's first comprehensive law dedicated to personal data. It received Presidential assent on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 that put it into operation were notified in November 2025. If your business collects names, phone numbers, email addresses, location, payment details or any other information about people in India, this law applies to you.
This guide explains the Act in plain English: who it covers, the vocabulary it uses, the core obligations, and how the phased timeline affects your planning. It is the first in our six-part series on the DPDP Act.
Why India needed a dedicated data protection law
Before the DPDP Act, personal data in India was protected mainly through Section 43A of the Information Technology Act, 2000 and the 2011 "SPDI Rules". Those rules covered only a narrow band of "sensitive" data, gave individuals few enforceable rights, and carried modest penalties. As India's digital economy grew — UPI, Aadhaar-linked services, e-commerce, ed-tech, health-tech — the gap between how data was used and how it was protected became impossible to ignore.
The Supreme Court's 2017 judgment in Justice K.S. Puttaswamy v. Union of India recognised privacy as a fundamental right and called for a data protection framework. After several drafts between 2018 and 2022, Parliament passed the DPDP Act in 2023 as a deliberately concise, principles-based law, leaving operational detail to the Rules.
Who the Act applies to
The Act applies to the processing of digital personal data — data about an identifiable individual that is either collected in digital form or collected offline and later digitised. It covers:
- Processing within India, regardless of the size of the organisation.
- Processing outside India if it is connected to offering goods or services to people in India — so a foreign SaaS company selling to Indian users is in scope.
There are important carve-outs. The Act does not apply to personal data processed by an individual for purely personal or domestic purposes, or to personal data that has been made publicly available by the individual themselves or by someone legally obliged to publish it (for example, a statutory register). Treat that second exclusion with care: it is narrow, and data "found on the internet" is not automatically covered by it.
The key roles and terms you need to know
The Act introduces its own vocabulary. Getting these terms right makes everything else easier to follow.
| Term | What it means | Everyday example |
|---|---|---|
| Data Principal | The individual the data relates to. For a child or a person with a disability, this includes their parent or lawful guardian. | A customer who signs up on your app |
| Data Fiduciary | Whoever decides the purpose and means of processing. | Your company, when it runs its CRM |
| Data Processor | Anyone who processes data on behalf of a Data Fiduciary. | Your cloud host, email provider or payroll vendor |
| Significant Data Fiduciary | A Data Fiduciary notified by the government because of the volume or sensitivity of data it handles, or the risk to individuals. | Large platforms, major financial or health services |
| Consent Manager | A registered entity that lets people give, manage, review and withdraw consent through one interoperable platform. | A consent dashboard used across many apps |
| Data Protection Board of India | The adjudicatory body that inquires into breaches and imposes penalties. | The regulator you notify of a breach |
Unlike the EU's GDPR, the Act does not create separate "special categories" of sensitive data. All personal data is treated alike, although children's data gets additional protection.
The two lawful grounds for processing
A Data Fiduciary may process personal data only for a lawful purpose and on one of two grounds:
- Consent — which must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose.
- Certain legitimate uses listed in Section 7 — for example, where an individual voluntarily provides data for a specified purpose and has not objected, for employment-related purposes, to comply with a law or court order, to respond to a medical emergency, or for specified State functions.
There is no broad "legitimate interests" ground of the kind found in GDPR. For most commercial processing — marketing, analytics, profiling, sharing with partners — consent will be the practical basis. We cover consent in depth in the next article in this series.
Core obligations of a Data Fiduciary
Once you are processing personal data, the Act places a set of continuing duties on you, regardless of whether you use a processor:
- Give a clear notice describing the personal data and the purpose, how individuals can exercise their rights, and how to complain to the Board.
- Ensure accuracy and completeness where data is used to make a decision about the person or is shared with another fiduciary.
- Implement reasonable security safeguards to prevent personal data breaches — the Rules name measures such as encryption, masking, access controls, monitoring logs and backups.
- Notify breaches to the Board and to each affected Data Principal.
- Erase data once the purpose is served or consent is withdrawn, unless the law requires you to retain it — and make your processors erase it too.
- Publish contact details of a Data Protection Officer (if you are a Significant Data Fiduciary) or of a person who can answer questions about processing.
- Run a grievance redressal mechanism that responds to complaints within the time the Rules allow.
Practical takeawayYou remain responsible for what your vendors do with the data. Every processor contract should now cover security, breach notification, sub-processing and erasure on instruction.
Rights of Data Principals — and their duties
Individuals gain four headline rights: the right to access information about how their data is processed and with whom it is shared, the right to correction, completion, updating and erasure, the right to grievance redressal, and the right to nominate someone to exercise their rights after death or incapacity.
Uniquely, the Act also places duties on Data Principals. They must not impersonate others, suppress material information when providing data for official documents, or file false or frivolous complaints. Breaching these duties can attract a penalty of up to ₹10,000.
The phased timeline under the 2025 Rules
The government chose a staggered rollout rather than a single "go-live" date:
- Immediately on notification (November 2025): provisions establishing the Data Protection Board and its procedures came into force.
- After 12 months: the framework for registering and running Consent Managers takes effect.
- After 18 months (around mid-2027): the substantive obligations — notice, consent, security safeguards, breach notification, rights handling, children's data and Significant Data Fiduciary duties — become enforceable.
Eighteen months sounds generous, but mapping data flows, rewriting notices, rebuilding consent capture and renegotiating vendor contracts routinely takes a year or more in a mid-sized business. The organisations that start now will be the ones that avoid a last-minute scramble.
How the DPDP Act compares with GDPR
Teams that already comply with GDPR have a head start, but the two laws are not interchangeable:
| Area | DPDP Act | GDPR |
|---|---|---|
| Scope | Digital personal data only | Digital and structured manual records |
| Lawful bases | Consent + specified legitimate uses | Six bases, including legitimate interests |
| Sensitive data | No separate category; extra rules for children | Special categories with stricter conditions |
| Children | Under 18; verifiable parental consent | Under 16 by default (member states may lower to 13) |
| Penalties | Fixed maximums up to ₹250 crore per breach | Up to 4% of global turnover or €20m |
| Cross-border transfers | Permitted unless the destination is restricted by notification | Adequacy, SCCs or other safeguards required |
Where to start
If you do one thing this quarter, build a data inventory: list every system that holds personal data, what it holds, why, where it is stored, who can access it and which vendors touch it. Almost every DPDP obligation — notice, consent, retention, rights requests, breach response — depends on knowing that map.
The rest of this series walks through each obligation in detail: consent and notices, Data Principal rights, breach response, children's data, and the penalties and compliance roadmap that tie it together.
