- Section 7(a), illustration
A customer gives a pharmacy her details and asks for a message acknowledging payment. The pharmacy may use the data for sending that receipt.
- Section 5(1)
A request for consent must be accompanied or preceded by a notice saying what personal data is processed and why, how the person can exercise their rights, and how to complain to the Board.
- Section 6(1)
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.
- Section 6(4)
A person can withdraw consent at any time, and withdrawing must be as easy as giving it.
- Section 6(10)
If asked in a proceeding, the business must be able to prove that notice was given and consent obtained as the Act requires.
- Section 7(i)
Processing for employment purposes is one of the Act's certain legitimate uses, so it does not need consent.
- Section 8(1) and 8(2)
The business stays responsible for processing done on its behalf, and may engage a processor only under a valid contract.
- Section 8(5) and 8(6)
It must take reasonable security safeguards to prevent a personal data breach, and must inform the Board and each affected person if one happens, in the prescribed form and manner.
- Section 8(7)
It must erase personal data when consent is withdrawn or when the purpose is no longer being served, unless law requires it to be kept.
- Section 8(9) and 8(10)
It must publish business contact details of a person who can answer questions about the processing, and have an effective way to resolve complaints.
- Section 9(1) to 9(3)
Before processing a child's data (a child is under 18) it must get verifiable parental consent, and it must not track or behaviourally monitor children or direct targeted advertising at them.
- Section 1(2) and the commencement note in the India Code copy
Provisions take effect on dates the Government notifies. By notification G.S.R. 843(E) of 13 November 2025, sections 3 to 5, 6(1) to 6(8), 6(10) and 7 to 17 take effect eighteen months after 13 November 2025; section 6(9) (Consent Managers) one year after; and sections 2, 18 to 26 and 35 to 43 on 13 November 2025.
Source: The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) — Gazette of India (e-Gazette), India Code. Official text read on 2026-10-20. We read the official text of the Act. The DPDP Rules, 2025 have not yet been checked against the official text, so nothing here relies on them. This is information, not legal advice, and it has not been reviewed by counsel. Read the Act itself.
This page describes what the law says. It does not say whether your business is compliant. What is DPDP?
See where your business stands.
Start with the free DPDP website scan, or talk to a specialist about getting DPDP-ready.