The DPDP Act, 2023 in plain language
The Act chapter by chapter, in the words the assessment uses. It is a digest for business owners, not the statute; the official text is linked at the end and always prevails.
The Act at a glance
The Digital Personal Data Protection Act, 2023 is India's first law dedicated to personal data. It received assent on 11 August 2023. Parts of it came into force on 13 November 2025, under a commencement notification issued the same day as the DPDP Rules; the rest follows in stages (see key dates).
Three roles run through it. The Data Principal is the person the data is about: a customer, student, patient, resident or employee. The Data Fiduciary decides why and how the data is used: usually your business. A Data Processor handles data on the fiduciary's behalf and on its instructions, such as billing software or a cloud host. An accountant, agency or courier may be either, depending on who decides how the data is used.
The duties sit with the fiduciary. There is no turnover threshold. The government may exempt notified classes of fiduciaries, including startups, from some duties (s. 17(3)); we are not aware of any such exemption having been notified. Under legal review: Whether any exemption under s. 17(3) has been notified should be confirmed against the e-Gazette.
Chapter I: Preliminary (sections 1 to 3)
Section 1 lets the government bring provisions into force on different dates, which is why the law arrives in stages.
Section 2 defines the terms. Personal data is any data about an individual who can be identified by or from it. Processing covers almost anything done with it, from collection and storage to sharing and erasure. A child is anyone under 18.
Section 3 sets the reach: digital personal data processed in India, whether collected digitally or on paper and digitised later, and processing outside India connected with offering goods or services to people in India. It does not apply to purely personal or domestic use, or to data a person has made public themselves or that is public under a legal duty.
Chapter II: Obligations of the Data Fiduciary (sections 4 to 10)
Section 4: personal data may be processed only for a lawful purpose, with the person's consent or for a listed legitimate use.
Section 5: when asking for consent, you must give a notice of what you collect, why, how the person can exercise their rights and how they can complain to the Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution. Where consent was given before the Act began, a notice must follow as soon as reasonably practicable.
Section 6: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose. Withdrawing it must be as easy as giving it. Consent can also be managed through a registered Consent Manager. If challenged, the fiduciary must show that notice was given and consent taken.
Section 7: the legitimate uses that permit processing without consent, including data a person volunteers for a specific purpose, employment, medical emergencies and certain functions of the State.
Section 8: the general duties. Be responsible for all processing done by you or for you; use processors only under a valid contract; keep data complete and accurate where it is used for decisions about the person; take reasonable security safeguards; report breaches to the Board and to each affected person; erase data once the purpose is served unless another law requires keeping it; publish a contact for data questions; and run a way to resolve grievances.
Section 9: children. Verifiable consent of a parent or lawful guardian is needed before processing a child's data. Processing likely to harm a child's well-being is prohibited, as are tracking, behavioural monitoring and targeted advertising directed at children.
Section 10: the government may notify some fiduciaries as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of data and the risk to people. They must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic impact assessments and audits.
Chapter III: Rights and duties of the Data Principal (sections 11 to 15)
Section 11: the right to a summary of the data held, the processing done, and who it was shared with.
Section 12: the right to correction, completion, updating and erasure.
Section 13: the right to grievance redressal. A person must first use your grievance process before going to the Board, so publish a contact that works.
Section 14: the right to nominate someone to exercise these rights in case of death or incapacity.
Section 15: duties of the Data Principal, such as not impersonating anyone and not filing false or frivolous complaints.
Chapter IV: Special provisions (sections 16 and 17)
Section 16: personal data may be transferred outside India except to countries the government restricts by notification. Stricter rules in other laws, such as sector rules on keeping payment data in India, still apply.
Section 17: exemptions, including processing to enforce legal rights, by courts, and for preventing and investigating offences. The government may also exempt notified classes, including startups, from some duties.
Chapters V and VI: The Data Protection Board (sections 18 to 28)
These chapters set up the Data Protection Board of India, a body designed to work digitally. It inquires into breaches when a business reports one, on a complaint, on a reference from the Central or a State Government, or on a court’s direction (s. 27). It can direct urgent measures during a breach and imposes the penalties in the Schedule. The Board’s inquiry and penalty powers apply from 13 May 2027. Developments about the Board after the Rules were notified are posted under Changes in the law, each with its source.
Chapter VII: Appeals and alternative dispute resolution (sections 29 to 32)
Orders of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal, generally within 60 days. The Board may refer a dispute to mediation, and may accept a voluntary undertaking: a business acknowledges a gap and commits to fix it within a set time. Proceedings on that matter are then barred unless the business fails to keep the undertaking, which is itself penalised (ss. 32 and 33).
Chapter VIII: Penalties and adjudication (sections 33 and 34)
The Board imposes civil penalties after an inquiry, considering the nature, gravity and duration of the breach, any repetition, any gain made or loss avoided, and what was done to limit it. Where it finds a significant breach, the maximum penalties in the Schedule are (s. 33):
| Failure | Up to |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failing to notify the Board or affected people of a breach | ₹200 crore |
| Breaching the additional duties for children | ₹200 crore |
| Breaching the additional duties of a Significant Data Fiduciary | ₹150 crore |
| Breaching any other provision of the Act or Rules | ₹50 crore |
| Breaking a voluntary undertaking accepted by the Board | Up to the penalty for the original breach |
| Breach of duties by a Data Principal | ₹10,000 |
These are ceilings, not fixed amounts: the Board must consider the factors above and keep the penalty proportionate. The highest ceiling is on security safeguards, and the next, ₹200 crore, on breach reporting and children’s data. That is one reason the assessment treats gaps in those areas as critical.
Chapter IX: Miscellaneous (sections 35 to 44)
The closing chapter covers protection for action taken in good faith, the government's power to call for information, rule-making powers and amendments to other laws. Two amendments matter in practice: personal information is now exempt from disclosure under section 8(1)(j) of the Right to Information Act, and section 43A of the Information Technology Act, the earlier compensation route for negligent handling of sensitive data, will be removed from 13 May 2027. The RTI change has applied since 13 November 2025.
How the Rules put these duties into practice, and when each part takes effect, is in the DPDP Rules, 2025 in plain language.
The official text
For the authoritative text, use the government sources directly. These links leave this site.
- The Digital Personal Data Protection Act, 2023 on India Code (Act No. 22 of 2023)
- The Act as published in the Gazette, from the Ministry of Electronics and Information Technology (PDF)
- The e-Gazette of India, which holds the original notifications, including the commencement notification G.S.R. 843(E) of 13 November 2025
Where this digest and the Gazette text differ, the Gazette text is right.