Digital Personal Data Protection Act 2023

Also called: DPDP Act · Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT

Meaning

The Digital Personal Data Protection (DPDP) Act 2023 (Act No. 22 of 2023) is India's law on how digital personal data may be collected and used. It covers data collected online, or collected offline and then digitised. Such data may be used only with the person's consent or for "certain legitimate uses". Bodies that handle the data (data fiduciaries) have duties, the people the data is about (data principals) have rights, and a Data Protection Board of India enforces the law with penalties [2][3].

It is India's first full law on data privacy. It puts into effect the right to privacy recognised in K.S. Puttaswamy v Union of India (2017). It also changed the RTI Act 2005, which makes it central to the debate on transparency versus privacy.

Explanation

How it works: scope, grounds and key actors

• Scope: It covers digital personal data processed in India [2].
• It also covers processing outside India if it is linked to offering goods or services to people in India.

• Personal data means any data about a person who can be identified from it.

• Ground 1: consent (s.6). Consent must be free, specific, informed, unconditional and unambiguous.

• It is given after a notice and can be withdrawn at any time.

• Under the Rules, every data fiduciary must give a separate, easy-to-read consent notice that states the exact purpose [1].

• Ground 2: "certain legitimate uses" (s.7). In these cases data can be used without consent:

• data a person shares voluntarily [2];
• State subsidies, benefits, services, licences and permits;
• legal obligations and court orders;
• medical emergencies, epidemics and disasters;

• certain employment purposes.

• Key actors:

• Data principal: the person the data is about. For a child, the parent or lawful guardian acts as the data principal. The same applies to the lawful guardian of a person with a disability who cannot act alone [1].
• Data fiduciary: the body that decides why and how data is processed [1].
• Data processor: a body that processes data on behalf of a fiduciary [1].
• Significant data fiduciary (SDF): a fiduciary notified by the Centre under s.10. The Centre looks at the volume and sensitivity of the data and at risks to people's rights, to the sovereignty of India, to electoral democracy, to State security and to public order.

• Consent manager: a body registered with the Board. It runs one interoperable platform (one that works across many services) where a person can give, review or withdraw consent across many platforms [1][3]. It is accountable to the data principal (s.6(8)) [3]. Under the Rules, it must be a company based in India [1].

• Seven core principles [1]: consent and transparency, purpose limitation (use data only for the stated purpose), data minimisation (collect only what is needed), accuracy, storage limitation (keep data only as long as needed), security safeguards and accountability.

Duties and rights

• Duties of data fiduciaries (s.8):
• keep data accurate and complete;
• keep reasonable security safeguards in place to prevent a breach (s.8(5));
• report every personal data breach to the Board and to each affected person (s.8(6)) [2]. Under the Rules, affected people must be told without delay, and a detailed report must reach the Board within 72 hours [1];
• erase the data once its purpose is over;

• name a contact point (a designated officer or a Data Protection Officer) and answer requests within 90 days [1].

• Extra duties of SDFs (s.10): appoint a DPO based in India, appoint an independent data auditor, and carry out Data Protection Impact Assessments (checks on how risky a data activity is for people's rights). Under the Rules, SDFs may have to store some data in India [1].

• Children (s.9):
• a child is anyone under 18 [2];
• verifiable parental consent is needed before using a child's data [3];
• the fiduciary must not track or monitor children's behaviour, and must not show them targeted advertising (s.9(3)) [3];

• under the Rules, parental consent is not needed for healthcare, education and real-time safety [1].

• Rights of data principals (ss.11–14):

• information about how their data is processed (s.11);
• correction, completion, updating and erasure (s.12);
• grievance redress, first with the fiduciary and then with the Board (s.13) [3];

• nomination of someone to use these rights after death or incapacity (s.14) [2].

• Duties of data principals (s.15): do not impersonate anyone, do not hide facts and do not file false complaints. The penalty is up to ₹10,000 [3].

• Missing rights: the Act gives no right to data portability (moving your data to another service) and no right to be forgotten [2].

Limits: transfer abroad and exemptions

• Cross-border transfer (s.16): data may go to any country unless the Centre has notified it as restricted. This is a "negative list" approach [2][3]. Stricter rules in other laws still apply (s.16(2)) [3].
• s.17(1): most duties do not apply when data is used to enforce legal rights, by courts, to prevent or investigate offences, or to trace loan defaulters, among other cases [3].
• s.17(2)(a): the Centre can exempt any notified instrumentality of the State (a government agency or body) from the whole Act. The grounds are sovereignty and integrity, State security, friendly relations with foreign States and public order [3].
• s.17(2)(b): research, archiving and statistics are exempt if the data is not used to make decisions about a particular person [3].
• s.17(3): the Centre can free notified fiduciaries, including startups, from some duties [3].

Enforcement: the complaint route, step by step

1. The person first complains to the fiduciary or consent manager.
2. Next, the person goes to the Data Protection Board of India (s.18) [3]. The Board holds an inquiry and may impose a penalty (s.33). Complaints are filed and tracked online [1].
3. An appeal against the Board goes to TDSAT (Telecom Disputes Settlement and Appellate Tribunal) within 60 days (s.29) [3].
4. A further appeal lies to the Supreme Court. - Board composition: a Chairperson and other members, as the Centre decides (s.19), with at least one legal expert [3]. The Rules fix the Board at four members [1]. Members serve a 2-year term and can be reappointed (s.20) [3]. - Voluntary undertaking (s.32): a fiduciary can give the Board a written promise to fix a problem. If it breaks that promise, it faces the penalty for the original breach [3]. - Blocking (s.37): after penalising a fiduciary two or more times, the Board can recommend blocking its platform. The Centre may then block it after a hearing [3]. - Penalties (s.33(1)) [3][1]:

Breach	Maximum penalty
No reasonable security safeguards (s.8(5))	₹250 crore
Breach not reported (s.8(6))	₹200 crore
Children's duties broken (s.9)	₹200 crore
Extra SDF duties broken (s.10)	₹150 crore
Any other breach	₹50 crore
Data principal's duties broken (s.15)	₹10,000

• Penalty money goes to the Consolidated Fund of India, not to victims [3].

In the Constitution and practice

• Constitutional base: In K.S. Puttaswamy v Union of India (2017), a nine-judge bench held that the right to privacy is a fundamental right under Article 21 (right to life and personal liberty). The DPDP Act is the law Parliament made to protect that right.
• Road to the Act:
• Justice B.N. Srikrishna Committee (set up 2017; report 2018) drafted the PDP Bill 2018. It wanted a strong, independent Data Protection Authority and data localisation (keeping copies of some data in India).
• The PDP Bill 2019 went to a Joint Parliamentary Committee, which reported in December 2021. The government withdrew it in August 2022.
• MeitY released a shorter draft DPDP Bill in November 2022.
• The DPDP Bill 2023 was introduced in the Lok Sabha on 3 August 2023. The Lok Sabha passed it on 7 August and the Rajya Sabha on 9 August 2023 [2].

• It received the President's assent on 11 August 2023 [1][3].

• DPDP Rules 2025: the draft came in January 2025 and drew 6,915 inputs [1]. The Rules were notified on 14 November 2025 and come into force in phases over 18 months [1]:

• at once: setting up and running the Board;
• after 12 months: registration of consent managers;

• after 18 months (about May 2027): most fiduciary duties, including notices, security, breach reporting, rights and children's data.

• RTI amendment: s.44(3) of the Act rewrote s.8(1)(j) of the RTI Act 2005 [3].

• Old rule: personal information was exempt only if it had no link to public activity, or if releasing it would be an unwarranted invasion of privacy. Even then, it had to be released if the larger public interest justified it.
• New rule: the section now simply exempts "information which relates to personal information" [3].

• Government's view: s.8(2) of the RTI Act still allows disclosure when the public interest outweighs the harm [1].

• Surveillance: the Act brings in no surveillance reform, even after the Pegasus spyware controversy (2021).

Don't confuse with

• RTI Act 2005: the RTI Act gives citizens access to government information. The DPDP Act protects personal data. The DPDP Act amended RTI s.8(1)(j), so the two now pull in opposite directions.
• EU GDPR (2018): the GDPR covers digital and paper data, has independent regulators, a separate category for sensitive data, data portability, a right to be forgotten and compensation for victims. The DPDP Act covers digital data only and has none of these.
• Srikrishna Committee's Data Protection Authority: the proposed Authority was meant to be an independent regulator. The Data Protection Board is appointed by the Centre, its size is set by the Centre and its members serve 2-year terms [2].
• Right to privacy (Article 21): privacy is a fundamental right created by court judgment (Puttaswamy, 2017). The DPDP Act is an ordinary statute that puts the right into practice for digital data.

Prelims Hooks

• Appeals against the Board go to TDSAT within 60 days (s.29), not to a High Court. A further appeal lies to the Supreme Court [3].
• The highest penalty is ₹250 crore, for failing to keep security safeguards. Breaking children's duties carries ₹200 crore [3].
• A child means anyone under 18. Tracking, behavioural monitoring and targeted ads aimed at children are banned (s.9(3)) [2][3].
• Trap: cross-border transfer uses a negative list, so every country is allowed unless notified (s.16). It is not a whitelist [2].
• Trap: the Act gives no right to data portability and no statutory right to be forgotten [2].
• s.44(3) of the DPDP Act amended s.8(1)(j) of the RTI Act 2005. The Board has four members under the Rules, and each serves a 2-year term with reappointment allowed (s.20) [1][3].

Mains Points

• Privacy versus State power:
• s.17(2)(a) lets the Centre exempt its own agencies from the whole Act [3].
• PRS notes that this has no proportionality safeguard (the Puttaswamy test that a limit on privacy must go no further than needed) [2].

• Reform: a written order for each exemption, with time limits and review by a judicial or parliamentary body.

• Independence of the regulator:

• The Centre appoints the Board and sets its size. Members get 2-year terms, while comparable regulators get 5 years [2]. Yet the State itself is the largest data fiduciary.

• Reform: an independent selection panel, 5-year terms and financial autonomy, as the Srikrishna Committee proposed.

• Transparency versus privacy, and remedies for victims:

• The new RTI s.8(1)(j) could shield records such as officials' assets and the names of beneficiaries in social audits. The government relies on s.8(2) to protect the public interest [1].
• Victims get no compensation, because penalties go to the Consolidated Fund of India [2][3].
• Reform: restore an explicit public-interest test in s.8(1)(j), allow compensation claims and add a sensitive-data category on the lines of the GDPR.

Related concepts

• Justice B.N. Srikrishna Committee
• Data fiduciary
• Data principal
• Consent manager
• Data Protection Board of India
• DPDP Rules 2025

Read more

• Data protection: the DPDP Act 2023 and Rules 2025