The DPDP Act, explained simply

It is a law passed by India’s Parliament in 2023. It sets rules for how organisations collect, use, store, share and delete information about people when that information is in digital form. Think of it as the rules of the road for your data.

Act s. 1, 3

Digital Personal Data Protection. “Digital” means stored on a phone, computer or server. “Personal data” means information about you. “Protection” means keeping it safe and using it fairly.

Your name, phone number, photos and where you go are valuable. Without rules, anyone could copy them, sell them or leak them by mistake. The Act makes organisations tell you what they collect, ask you properly, keep it safe and delete it when they are done.

It is coming in stages. The DPDP Rules were published on 13 November 2025, and the Data Protection Board was set up from that day. Registration of Consent Managers starts on 13 November 2026. Most duties for organisations, such as notices, consent, security, breach reporting, children’s data and your rights, start on 13 May 2027.

Rule 1

Any person or organisation that decides why and how your data is used: shops, schools, hospitals, banks, apps, websites, housing societies and government departments. It also covers companies outside India that process data to sell goods or services to people in India.

Act s. 2(i), 3(a)–(b)

Any information about a person who can be identified from it, either by itself or together with other information. Your name, phone number, face, address, fingerprint, school marks, height and even the clothes size written next to your name are all personal data.

Act s. 2(t)

Personal data that is in digital form: typed into an app, saved in a computer, scanned, photographed on a phone or sent in a message.

Act s. 2(n)

Only once it becomes digital. The Act applies when personal data is collected in digital form, or collected on paper and digitised later, for example typed into a computer, scanned, or photographed and saved on a phone. A paper notebook that never becomes digital is outside the Act.

Act s. 3(a)

Yes. Chest 34, waist 28 and sleeve 22, written next to your name and phone number, is information about you, so it is personal data.

Act s. 3(a), 3(c)(i)

Yes. Your name, age, illness, blood tests, X-rays and prescriptions are all information about you. The Act does not have a separate category for health data, but all personal data must be protected, and a big hospital chain can be given extra duties.

Act s. 3(a), 7(f), 8(5)–(6), 11, 12

Yes. Numbers like −1.25 for your eye power or 62 mm between your pupils, saved under your name, are information about you.

Act s. 4, 6(1)

Yes. A phone number can be used to find and identify you, so it is personal data.

Act s. 3(a), 7(a), 8(7)

Personal data: your marks in the school app, your photo on a school ID card, your Aadhaar number, your face in CCTV footage, the location your phone shares, your voice in a voice note. Not personal data: “200 people visited the mall today”, because no one can be identified from it.

Act s. 2(t)

No. If you make your own data public yourself, for example in a public blog post or a public social-media profile, the Act does not apply to that data. The same goes for data that a law requires someone to publish.

Act s. 3(c)(ii)

You: the person the data is about. For a child, it also includes the parent or lawful guardian. For a person with a disability, it includes the lawful guardian acting for them.

Act s. 2(j)

The organisation that decides why and how your data is used, such as the school, the hospital or the app. “Fiduciary” means someone you trust to look after something for you, so it must act responsibly with your data.

Act s. 2(i)

A helper that handles data for the Data Fiduciary, such as a cloud company that stores the files or a company that sends SMS messages. The Data Fiduciary stays responsible for what the helper does.

Act s. 2(k), 8(1)–(2)

A company registered with the Data Protection Board that gives you one place to give, see, manage and withdraw your consents across many organisations. myconsentapp is a proposed Consent Manager, not yet registered with the Board.

Act s. 2(g), 6(7)–(9); Rule 4

The referee. It hears complaints, looks into data leaks, registers Consent Managers and can impose penalties. It works as a digital office, so you can approach it online.

Act s. 2(c), 18, 27

Saying a clear “yes”. Under the Act, consent must be free (no one forces you), specific (for a stated purpose), informed (you know what you are agreeing to), unconditional and unambiguous, given by a clear action such as ticking a box yourself. Silence or a box that was already ticked does not count.

Act s. 6(1)

A short, clear message given before they ask for consent. It tells you what data they want and why, how to withdraw your consent or raise a complaint, and how to complain to the Board. You can choose to read it in English or in any of the 22 languages in the Eighth Schedule of the Constitution.

Act s. 5; Rule 3

It can ask, but your consent only counts for the data that is necessary for the purpose. Any extra part is not valid.

Act s. 6(1)–(2)

Yes. You can withdraw consent at any time, and withdrawing must be as easy as giving it. The organisation must then stop using your data within a reasonable time. Things done before you withdrew stay valid, and you may lose the service that needed the data.

Act s. 6(4)–(6)

Yes, but only for “certain legitimate uses” listed in the Act. These include data you gave voluntarily for a purpose, government benefits and services, legal duties and court orders, medical emergencies, epidemics, disasters, and employment.

Act s. 7

Yes. You can ask for a summary of the personal data it holds about you, what it does with it, and the other organisations it has shared it with.

Act s. 11

Yes. You can ask them to correct wrong data, complete missing data, update old data, or erase it. They may keep data only if it is still needed for the purpose or another law requires it.

Act s. 12

First complain to the organisation itself, using the grievance contact it must publish. It must answer within the time it publishes, which cannot be more than 90 days. If you are still not satisfied, you can complain to the Data Protection Board.

Act s. 8(9)–(10), 13; Rule 14

You can name another person, called a nominee, in advance. If you die or become unable to act, that person can use your rights for you.

Act s. 14

Yes. The Act gives duties to individuals too, not only to organisations. Do not pretend to be someone else when giving your data. Do not hide important facts when applying for a government ID or document. Give only true information when you ask for a correction. And do not file false or silly complaints. Breaking these duties can mean a penalty of up to ₹10,000.

Act s. 15; Schedule item 5

Anyone who has not turned 18.

Act s. 2(f)

Only after getting verifiable consent from a parent or lawful guardian. The app must check that the person saying “I am the parent” really is an adult, using reliable identity and age details it already has, details the parent provides, or a digital token from an authorised service such as DigiLocker.

Act s. 9(1); Rule 10

No. Organisations must not track or monitor the behaviour of children, must not show them ads targeted at them, and must not use their data in any way likely to harm their well-being. A few exceptions, such as schools, hospitals and child-safety purposes, are listed in the Rules.

Act s. 9(2)–(4); Rule 12, Fourth Schedule

If they have a lawful guardian, the guardian’s verifiable consent is needed, and the guardian can act for them.

Act s. 2(j)(ii), 9(1); Rule 11

Use it only for the purpose they told you, keep it accurate when it is used to make decisions about you, protect it with proper security, use only helpers bound by a contract, delete it when the purpose is over, and publish a contact person who can answer your questions.

Act s. 8

A breach is when personal data is leaked, stolen, changed, destroyed or used without permission, even by accident. The organisation must tell each affected person and the Board without delay, and send the Board a detailed report within 72 hours.

Act s. 2(u), 8(6); Rule 7

Up to ₹250 crore for not protecting data properly, up to ₹200 crore for not reporting a breach or for breaking the rules on children, up to ₹150 crore for a Significant Data Fiduciary missing its extra duties, and up to ₹50 crore for other violations. The Board decides the amount.

Act s. 33; Schedule

An organisation the government names because it handles a lot of data, or very sensitive data, or poses higher risk. It must appoint a Data Protection Officer based in India, hire an independent data auditor and run regular risk checks.

Act s. 10

Generally yes, unless the government has restricted transfers to that country. Stricter rules in other Indian laws, such as for banking data, still apply.

Act s. 16

Personal or household use, such as your family’s WhatsApp group or your own diary app. Data you made public yourself. Paper records that are never digitised. And some special cases, such as courts, crime investigation, certain government bodies, and research that is not used to take decisions about a person.

Act s. 3(a), 3(c), 17