The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first dedicated law on the processing of digital personal data. It balances two ideas: individuals have a right to protect their personal data, and organisations need to process it for lawful purposes.
What the Act covers
- Personal data in digital form, or non-digital data that is later digitised.
- Processing inside India.
- Processing outside India if it is connected with offering goods or services to individuals in India.
What it does not cover
- Personal data processed by an individual for personal or domestic purposes.
- Personal data that the individual themselves made public, or that someone else made public under a legal obligation to publish it.
What it asks of businesses
- Tell people what you collect and why (notice), and ask for consent in plain language - unless a legitimate use applies.
- Keep data accurate, secure and only as long as needed.
- Make it as easy to withdraw consent as to give it.
- Run a grievance process and honour access, correction and erasure rights.
- Report personal data breaches.
- Take extra care with children's data.
What it asks of individuals
Data Principals also have duties - for example, not to impersonate another person or file false or frivolous complaints.
Key terms in one place
| Term | Meaning |
|---|---|
| Digital personal data | Any data about an identifiable individual that is collected in digital form, or collected non-digitally and later digitised. |
| Data Principal | The individual the data is about. For a child, this includes the parent or lawful guardian; for a person with a disability, their lawful guardian. |
| Data Fiduciary | The person or business that decides why and how personal data is processed - alone or with others. |
| Data Processor | A person who processes personal data on behalf of a Data Fiduciary (for example a cloud, SMS or payroll vendor). |
| Consent Manager | An entity registered with the Data Protection Board that gives Data Principals a single, accessible way to give, manage, review and withdraw consent. |
| Significant Data Fiduciary | A Data Fiduciary (or class) notified by the Central Government based on factors such as volume and sensitivity of data and risk to individuals. |
Frequently asked questions
Does the DPDP Act only apply to big companies?+
No. It applies to any Data Fiduciary processing digital personal data within its scope. Certain classes, such as notified startups, may receive relaxations - check the latest notifications.
Is consent always required?+
No. Consent is one ground. The Act also lists 'legitimate uses' such as voluntarily provided data for a specified purpose, certain employment purposes and legal obligations.
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.