The DPDP Act, explained in ten minutes

India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) is the country’s first comprehensive law on personal data. It answers three questions: what companies may do with your digital personal data, what you can do about it, and who enforces the rules.

This guide walks through the essentials in plain language.

What it covers

The Act applies to digital personal data: any data about an identifiable individual that is collected in digital form, or collected on paper and digitised later. Your name, phone number, location, purchase history and health records all qualify.

It applies to processing within India, and to processing outside India when it is connected to offering goods or services to people in India. Two things are outside its scope: data you use for purely personal or domestic purposes, and data you have made publicly available yourself.

The people involved

The Act uses a few terms you will see everywhere:

• Data Principal: you, the person the data is about. For a child (anyone under 18), this includes the parent or lawful guardian.
• Data Fiduciary: the company that decides why and how your data is processed, such as your bank, an app or an online shop.
• Data Processor: a vendor that processes data on a fiduciary’s behalf. The fiduciary stays responsible for what it does.
• Consent Manager: a company registered with the Board that lets you give, review and withdraw consent from one place.
• Data Protection Board of India: the body that handles complaints, investigates breaches and imposes penalties.

Consent is the default

Most processing needs your consent, and the Act sets a high bar for it. Consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. A company may only ask for data that is necessary for the purpose it states.

Before asking, the company must give you a notice that tells you what data it wants and why, how to withdraw consent and use your rights, and how to complain to the Board. You can ask for this notice in English or any of the 22 languages in the Eighth Schedule of the Constitution.

You can withdraw consent at any time, and doing so must be as easy as giving it.

There are some exceptions, which the Act calls legitimate uses. For example, a company can process data you voluntarily gave it for a specific purpose, or data it needs to comply with a law or respond to a medical emergency, without asking for separate consent.

What companies must do

Beyond getting consent right, every Data Fiduciary must:

1. Keep data accurate and complete when it is used to make decisions about you.
2. Take reasonable security safeguards to prevent breaches.
3. Report breaches to the Board and to every affected person.
4. Erase data once the purpose is served or consent is withdrawn, unless a law requires it to be kept.
5. Publish contact details for someone who can answer questions about your data, and run a working grievance process.

Companies the Government notifies as Significant Data Fiduciaries, based on factors like the volume and sensitivity of data they process, have extra duties: a Data Protection Officer based in India, an independent data auditor, and periodic impact assessments.

Children’s data

A company needs verifiable consent from a parent or lawful guardian before processing a child’s data. It must not process children’s data in ways likely to harm their well-being, and it must not track, behaviourally monitor or target advertising at children.

Penalties

The Board can impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or meet children’s data obligations, and up to ₹50 crore for most other breaches.

When it applies

The Act was passed in August 2023. The DPDP Rules, 2025 were notified in November 2025 and come into force in phases: the Board first, Consent Manager registration after about a year, and most company obligations after about 18 months.

What this means for you

You now have enforceable rights over your data, and a legal expectation that saying “no” or changing your mind is easy. Read your rights under the DPDP Act to see how to use them, or learn what a Consent Manager does for you.