The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. With the DPDP Rules, 2025 notified on 13 November 2025, the law is being brought into force in phases. The core obligations apply from 13 May 2027.
Who does it apply to?
The Act applies to the processing of digital personal data within India, whether collected online or collected offline and later digitised. It also applies to processing outside India if it relates to offering goods or services to people in India (Section 3).
Key roles
- Data Principal: the individual to whom the data relates. For a child, this includes the parent or lawful guardian.
- Data Fiduciary: the person who decides the purpose and means of processing. Most businesses, schools, hospitals and professional firms are Data Fiduciaries.
- Data Processor: a person who processes data on behalf of a Fiduciary, such as a cloud, payroll or CRM vendor.
- Significant Data Fiduciary: a Fiduciary notified by the government based on the volume and sensitivity of data and the risks involved. Additional obligations apply.
- Consent Manager: a registered entity that lets Data Principals give, manage and withdraw consent.
Timeline
| Date | What applies |
|---|---|
| 13 Nov 2025 | Definitions; Data Protection Board of India established |
| 13 Nov 2026 | Consent Manager registration framework |
| 13 May 2027 | Notice, consent, Fiduciary obligations, children's data, Data Principal rights, cross-border transfers and penalties |
Notice and consent
Every request for consent must be accompanied by a notice (Section 5) that explains the personal data and the purpose of processing, how to exercise rights, and how to complain to the Board. The notice must be available in English or any language in the Eighth Schedule to the Constitution.
Consent (Section 6) must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the purpose. Pre-ticked boxes do not work. Withdrawing consent must be as easy as giving it.
Legitimate uses
Section 7 permits processing without consent in limited cases, for example where a person voluntarily provides data for a specified purpose and does not object to its use, for certain employment purposes, for medical emergencies, and to comply with law or court orders.
Obligations of Data Fiduciaries
- Remain responsible for processing done by processors on their behalf, and engage processors only under a valid contract (Section 8(1), (2)).
- Ensure accuracy and completeness where data is used to make decisions about the person (Section 8(3)).
- Take reasonable security safeguards to prevent personal data breaches (Section 8(5)).
- Inform the Data Protection Board and each affected Data Principal of a breach (Section 8(6)).
- Erase data when the purpose is served or consent is withdrawn, unless retention is required by law (Section 8(7)).
- Publish the contact details of a person who can answer questions about processing, and set up a grievance redressal mechanism (Section 8(9), (10)).
Children's data
A "child" is anyone under 18. Processing a child's data requires verifiable consent of the parent or lawful guardian. Processing likely to harm a child's well-being, and tracking, behavioural monitoring or targeted advertising directed at children, are prohibited (Section 9).
Rights of Data Principals
- Right to access information about the data processed and with whom it was shared (Section 11)
- Right to correction, completion, updating and erasure (Section 12)
- Right to grievance redressal, which must be exhausted before approaching the Board (Section 13)
- Right to nominate a person to exercise rights in case of death or incapacity (Section 14)
Penalties
The Data Protection Board can impose penalties of up to ₹250 crore for failure to take reasonable security safeguards, up to ₹200 crore for failure to report a breach or to meet the obligations on children's data, up to ₹150 crore for breach of Significant Data Fiduciary obligations, and up to ₹50 crore for other breaches. Appeals lie to the TDSAT within 60 days (Section 29).
A practical checklist
- Map your data: what you collect, why, where it is stored, who can access it and who you share it with.
- Rewrite notices and consent flows. Remove pre-ticked boxes and bundled consent.
- Review vendor contracts and add data processing terms.
- Put security safeguards and access controls in place, and document them.
- Prepare a breach response plan with clear responsibilities.
- Set retention periods and an erasure process.
- Appoint a contact person and publish a grievance process.
- Check whether you process children's data, and how you will verify parental consent.
- Train your staff.
Where do you stand? Take the free DPDP Readiness Check to see your gaps in two minutes.
This article is general information and is not legal advice. Facts matter, so please consult an advocate about your situation.