The Act received Presidential assent in August 2023. Provisions come into force in phases by notification - see the deadlines page. Below is a plain-language map of the sections most businesses meet first.
| Section | Subject | In short |
|---|---|---|
| s.4 | Grounds for processing | Consent, or one of the 'legitimate uses'. |
| s.5 | Notice | Tell the person what data, for what purpose, how to exercise rights and how to complain to the Board. |
| s.6 | Consent | Free, specific, informed, unconditional, unambiguous; clear affirmative action; limited to the purpose; withdrawable as easily as given. |
| s.7 | Legitimate uses | Cases where consent is not needed, e.g. voluntarily provided data for a specified purpose, certain employment purposes, legal obligations, medical emergencies. |
| s.8 | Fiduciary obligations | Accountability incl. for processors; accuracy; reasonable security; breach intimation; erasure; published contact point; grievance redressal. |
| s.9 | Children | Verifiable parental consent; no detrimental processing; no tracking, behavioural monitoring or targeted advertising directed at children (with exemptions). |
| s.10 | Significant Data Fiduciaries | Data Protection Officer in India, independent data auditor, periodic impact assessments and audits. |
| s.11-14 | Data Principal rights | Information, correction/erasure, grievance redressal, nomination. |
| s.15 | Duties of Data Principals | Do not impersonate, suppress material information, or file false complaints. |
| s.16 | Transfers outside India | Allowed except to countries the Central Government restricts; stricter sectoral laws still apply. |
| s.17 | Exemptions | Specified purposes (e.g. legal rights enforcement, prevention of offences) and notified classes (e.g. certain startups, research with standards). |
Penalties
The Schedule to the Act lists maximum monetary penalties, imposed by the Data Protection Board after inquiry. The highest tier applies to failure to maintain reasonable security safeguards; other tiers cover breach notification, children's obligations, Significant Data Fiduciary obligations and general non-compliance. Refer to the Schedule for exact amounts.
Frequently asked questions
Who enforces the Act?+
The Data Protection Board of India, a digital-first body constituted under the Act, inquires into breaches and imposes penalties.
Can an individual claim compensation under the Act?+
The Act empowers the Board to impose penalties; it does not create a general private right to compensation. Seek legal advice for specific situations.
- Section 9Rule 10 · pending verificationChildren's personal data
- Section 10Rule 13 · pending verificationSignificant Data Fiduciary duties
- Section 16Rule 15 · pending verificationCross-border transfer
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
- Section 7Legitimate uses (alternative to consent)
- Section 8(1)Fiduciary accountability, incl. processors
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.