Data protection: the DPDP Act 2023 and Rules 2025

Detail

1. The road to the Act

Step	Year	What happened
K.S. Puttaswamy v Union of India	2017	A nine-judge bench of the Supreme Court held that the right to privacy is a fundamental right under Article 21 (life and personal liberty). Full treatment is in the fundamental-rights note.
Justice B.N. Srikrishna Committee	set up 2017; report 2018	This was an expert committee on data protection. Its 2018 report and draft Personal Data Protection (PDP) Bill 2018 aimed at a "free and fair digital economy". It proposed a strong Data Protection Authority and data localisation (keeping copies of some data on servers inside India).
PDP Bill 2019	2019–2022	It was sent to a Joint Parliamentary Committee (JPC), a committee of MPs from both Houses. The JPC reported in December 2021. The government withdrew the Bill in August 2022.
Draft DPDP Bill	November 2022	MeitY put a shorter draft out for public comment.
DPDP Bill 2023	August 2023	Introduced in the Lok Sabha on 3 August 2023. Passed by the Lok Sabha on 7 August and by the Rajya Sabha on 9 August 2023 [3].
DPDP Act 2023 (Act No. 22 of 2023)	11 August 2023	Received the President's assent [2][4].

• Seven core principles of the Act [2]:
• consent and transparency;
• purpose limitation (use data only for the stated purpose);
• data minimisation (collect only what is needed);
• accuracy;
• storage limitation (do not keep data longer than needed);
• security safeguards;

• accountability.

• The government calls the drafting style SARAL: Simple, Accessible, Rational and Actionable. The Act uses plain language and illustrations [2].

2. Scope and grounds for processing

• Scope: The Act covers digital personal data processed in India. This means data collected online, or collected offline and then digitised [3].

• It also covers processing outside India if it is linked to offering goods or services to people in India.

• Personal data is any data about a person who can be identified from it.

• Ground 1: consent (s.6). Consent must be free, specific, informed, unconditional and unambiguous. It must be given after a notice and can be withdrawn at any time.

• Under the Rules, every data fiduciary must give a separate, easy-to-read consent notice that states the exact purpose [2].

• Ground 2: "certain legitimate uses" (s.7). In these cases, data can be processed without consent:

• data a person shares voluntarily [3];
• State subsidies, benefits, services, licences and permits;
• legal obligations and court orders;
• medical emergencies, epidemics and disasters;
• certain employment purposes.

3. Key actors (definitions)

• Data principal: the person the data is about.
• For a child, the parent or lawful guardian counts as the data principal.

• For a person with a disability who cannot act alone, the lawful guardian counts as the data principal [2].

• Data fiduciary: the person or body that decides why and how personal data is processed, alone or with others [2].

• Data processor: a body that processes data on behalf of a data fiduciary [2].
• Significant data fiduciary (SDF): a data fiduciary notified by the Centre under s.10. The Centre looks at:
• the volume and sensitivity of the data;
• risk to the rights of data principals;

• risk to the sovereignty and integrity of India, electoral democracy, State security and public order.

• Consent manager: a body registered with the Board that runs a single, transparent and interoperable platform. Through it, a person gives, manages, reviews or withdraws consent across many platforms [2][4].

• It is accountable to the data principal (s.6(8)) [4].
• Under the Rules, consent managers must be companies based in India [2].

4. Duties of data fiduciaries (s.8)

• Keep data accurate and complete.
• Maintain reasonable security safeguards to prevent a breach (s.8(5)).
• Report every personal data breach to the Board and to each affected person (s.8(6)) [3].
• Under the Rules, affected persons must be told without delay and in plain language. The message must explain what happened, the likely impact, the steps taken and a contact for help [2].

• A detailed report must go to the Board within 72 hours.

• Erase the data once its purpose is over, unless a law requires it to be kept.

• Show a contact point: a designated officer or a Data Protection Officer (DPO) [2].
• Answer requests from data principals (access, correction, updating, erasure) within 90 days [2].
• Extra duties of SDFs (s.10):
• appoint a DPO based in India;
• appoint an independent data auditor;
• carry out Data Protection Impact Assessments (checks on the risk a data activity poses to people's rights) and periodic audits.
• Under the Rules, SDFs must also apply stricter checks to new or sensitive technologies. They must follow government directions on restricted data, including storing some data in India [2].

5. Children (s.9)

• A child is anyone under 18 [3].
• The fiduciary must get verifiable parental consent before processing a child's data. The same rule applies to a person with a disability who has a lawful guardian [4].
• The fiduciary must not track or monitor the behaviour of children. It also must not show them targeted advertising (s.9(3)) [4].
• Under the Rules, parental consent is not needed for essential services such as healthcare, education and real-time safety [2].

6. Rights and duties of data principals (ss.11–15)

• Rights:
• to information about how their data is processed (s.11);
• to correction, completion, updating and erasure (s.12);
• to grievance redress: the person first complains to the fiduciary or consent manager, then to the Board (s.13) [4];

• to nominate someone to use these rights after death or incapacity (s.14) [3].

• Duties (s.15): obey the law, do not impersonate anyone, do not hide facts, do not file false or frivolous complaints. Breaking a duty carries a penalty of up to ₹10,000 [4].

• The Act gives no right to data portability (moving your data to another service) and no right to be forgotten [3]. (The right to be forgotten as a court-made right is in the fundamental-rights note.)

7. Cross-border transfer and exemptions

• s.16 (cross-border transfer): data may go to any country unless the Centre has notified it as restricted. This is called a "negative list" approach [3][4].

• Any other law with stricter rules on transfers still applies (s.16(2)) [4].

• s.17(1): most duties do not apply when data is processed to enforce legal rights, by courts or regulators, to prevent or investigate offences, or to trace loan defaulters, among other cases [4].

• s.17(2)(a): the Centre can exempt any notified instrumentality of the State (a government agency or body) from the whole Act. The grounds are the sovereignty and integrity of India, security of the State, friendly relations with foreign States, public order, or preventing incitement to related offences [4].
• s.17(2)(b): research, archiving and statistics are exempt if the data is not used for decisions about a particular person [4].
• s.17(3): the Centre can free notified fiduciaries, including startups, from some duties [4].

8. Enforcement: Data Protection Board of India

• Data Protection Board of India: set up by the Centre under s.18 [4]. It inquires into breaches, directs urgent steps after a breach, hears complaints and imposes penalties [3].
• Composition: the Act provides for a Chairperson and "such number of other Members" as the Centre notifies (s.19). At least one must be a legal expert [4]. The Rules fix the Board at four members [2].
• Term: 2 years, and members can be reappointed (s.20) [4].

• Digital office: complaints are filed and tracked online, through a portal and a mobile app [2].

• How a complaint moves:

• the person complains to the fiduciary first;
• then to the Board, which holds an inquiry and may impose a penalty (s.33);
• an appeal goes to TDSAT (Telecom Disputes Settlement and Appellate Tribunal) within 60 days (s.29) [4];

• a further appeal lies to the Supreme Court.

• Voluntary undertaking (s.32): a fiduciary may give the Board a written promise to fix a problem. Breaking that promise draws the penalty of the original breach [4].

• s.36: the Centre may ask the Board, any fiduciary or any intermediary for information [4].
• s.37 (blocking): the Board can recommend blocking a platform after it has penalised the fiduciary two or more times. The Centre can then order the platform blocked "in the interests of the general public", after giving the fiduciary a hearing [4].

Schedule of penalties (s.33(1)) [4][2]

Breach	Maximum penalty
Failing to keep reasonable security safeguards (s.8(5))	₹250 crore
Failing to notify the Board or affected persons of a breach (s.8(6))	₹200 crore
Breaking duties towards children (s.9)	₹200 crore
Breaking extra duties of an SDF (s.10)	₹150 crore
Breaking a voluntary undertaking (s.32)	Same as the original breach
Any other breach	₹50 crore
Breaking a data principal's duties (s.15)	₹10,000

• Penalty money goes to the Consolidated Fund of India [4].

9. DPDP Rules 2025: phased start

• Draft Rules: released in January 2025. The consultation drew 6,915 inputs, with meetings in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru and Chennai [2].
• Notified: 14 November 2025 (gazette dated 13 November) [2].
• Phased compliance over 18 months [2]:
• At once (November 2025): provisions on setting up and running the Board.
• After 12 months (about November 2026): registration of consent managers.
• After 18 months (about May 2027): most fiduciary duties, including notices, security, breach reporting, rights and children.

10. RTI amendment (s.44(3))

• Old s.8(1)(j) of the RTI Act 2005: personal information was exempt only if it had no link to public activity or interest, or would be an unwarranted invasion of privacy. Even then, it had to be released if the larger public interest justified it. Information that cannot be denied to Parliament could not be denied to a citizen.
• New s.8(1)(j): simply exempts "information which relates to personal information" [4].
• Government's view: the change follows Puttaswamy and what courts were already doing. s.8(2) of the RTI Act (disclosure when public interest outweighs harm) still applies [2].
• Critics' view: the public-interest test inside s.8(1)(j) is gone. This makes it easier to refuse information, for example about officials' assets or the names of beneficiaries in social-audit records (see Section 4 of the parent note).

11. Critiques

• Wide State exemptions:
• s.17(2)(a) lets the Centre exempt its own agencies from the whole Act. PRS notes this could allow data to be collected, processed and kept "beyond what is necessary", with no proportionality safeguard [3]. Proportionality is the Puttaswamy test that any limit on privacy must be no more than needed.

• There is no surveillance reform, even after the Pegasus spyware controversy (2021; see Section 12).

• Board controlled by the executive:

• the Centre appoints, services and sets the size of the Board;
• a 2-year renewable term may weaken independence; comparable regulators get 5 years [3];

• the Srikrishna Committee had proposed an independent Authority instead.

• No compensation for victims: the 2019 Bill regulated "harms" and allowed compensation. The 2023 Act does neither, and all penalties go to the government [3][4].

• Missing rights: no right to data portability and no right to be forgotten [3].
• Age of consent at 18: higher than the USA (13), the UK (13) and the GDPR (16, which countries can lower to 13). This makes age checks hard to apply [3].
• Weak checks on cross-border transfer: the negative-list approach may not test whether the receiving country protects data properly [3].
• Comparison with the EU GDPR (General Data Protection Regulation, 2018):

Feature	EU GDPR	DPDP Act 2023
Regulator	Independent supervisory authorities	Board appointed by the executive
Sensitive data	Separate category with stronger protection	No separate category
Portability and right to be forgotten	Yes	No [3]
Compensation to victims	Yes	No
Exemptions for the State	Narrow, must be proportionate	Broad (s.17(2)(a))
Data covered	Digital and paper	Digital only

Prelims Hooks

• The DPDP Act 2023 (Act No. 22 of 2023) got assent on 11 August 2023. The DPDP Rules 2025 were notified on 14 November 2025 with an 18-month phase-in [2][4].
• Appellate body = TDSAT, not the High Court. Appeals must be filed within 60 days (s.29) [4].
• Highest penalty = ₹250 crore, for failing to keep security safeguards, not for a breach of children's duties (₹200 crore) [4].
• s.37: the Centre can block a platform only on a Board reference after two or more penalties [4].
• s.44(3) of the DPDP Act amended s.8(1)(j) of the RTI Act 2005 [4].
• Children = under 18. Tracking, behavioural monitoring and targeted ads aimed at children are banned (s.9(3)) [3][4].
• Board size: the Act leaves it to the Centre; the Rules fix four members. The term is 2 years with reappointment [2][4].
• Trap: the Act gives no right to data portability and no statutory right to be forgotten [3].
• Trap: cross-border transfer uses a negative list (all countries allowed unless notified), not a whitelist [3].
• Srikrishna Committee (2018) → PDP Bill 2018; JPC (December 2021) → PDP Bill 2019 withdrawn August 2022.

Mains Points

• Privacy versus State power: s.17(2)(a) lets the executive exempt its own agencies from the whole Act. This sits uneasily with the Puttaswamy (2017) tests of legality, necessity and proportionality. Reform: require a written order for each exemption, with time limits and review by a judicial or parliamentary body [3][4].
• Independent regulator: the Board is appointed by the Centre, has short 2-year terms and is serviced by MeitY [3]. Yet the State is itself the largest data fiduciary. Reform: an independent selection panel, 5-year terms and financial autonomy, as the Srikrishna Committee wanted.
• Transparency versus privacy: the new RTI s.8(1)(j) could shield officials' records. The government relies on s.8(2) to protect the public interest [2]. Answer angle: bring back an explicit public-interest test so that social audits and MKSS-style accountability survive.
• Citizen-centred design versus remedies: the Act has a digital Board, a 90-day response rule and consent managers [2]. But victims get no compensation, as penalties go to the Consolidated Fund [3][4]. Reform: allow compensation claims and add a sensitive-data category, in line with the GDPR.