Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection (DPDP) Act, 2023 is an important Indian law designed to protect individuals’ digital personal data while allowing its lawful processing. It received the President’s assent on 11 August 2023. The Act establishes a legal framework defining the responsibilities of organisations that process personal data and the rights and duties of individuals.
The Digital Personal Data Protection Rules, 2025 provide the operational framework for implementing the Act. The Act and Rules are important for UPSC and UPPSC examinations, particularly under Indian Polity, Governance, Cybersecurity, Digital India and Fundamental Rights.
Background of the DPDP Act, 2023
The growth of digital payments, e-commerce, social media, online education and digital governance has increased the collection and use of personal information. Such information may include names, contact details, identification information, financial details and other data that can identify an individual.
The Supreme Court of India recognised the right to privacy as a fundamental right in the landmark Justice K.S. Puttaswamy v. Union of India (2017) judgment. The judgment strengthened the constitutional foundation for protecting personal information and privacy.
The DPDP Act, 2023 was enacted to establish a statutory framework for processing digital personal data. It seeks to balance two important objectives: protecting individuals’ privacy and permitting the lawful use of personal data for legitimate purposes.
The Central Government notified the Digital Personal Data Protection Rules, 2025 in November 2025. The Act provides for phased commencement, meaning different provisions become effective on different dates.
Objectives of the DPDP Act
The major objectives of the Digital Personal Data Protection Act are:
- Protection of privacy: Safeguarding individuals against unlawful or inappropriate processing of their digital personal data.
- Consent-based processing: Ensuring that consent is obtained where required by law.
- Accountability: Making organisations responsible for complying with data protection requirements.
- Transparency: Requiring organisations to communicate relevant information about data processing.
- Individual empowerment: Providing individuals with rights relating to access, correction, erasure and grievance redressal.
- Secure digital governance: Strengthening trust in digital services and India’s digital economy.
- Responsible innovation: Enabling lawful data use while establishing safeguards against misuse.
Scope and Applicability of the DPDP Act
The Act primarily applies to digital personal data processed within India. It also covers personal data collected in non-digital form and subsequently digitised.
It can apply to processing outside India when such processing is connected with offering goods or services to individuals within India.
However, the Act provides certain exclusions. These include personal data processed by an individual for personal or domestic purposes and certain personal data that has been made publicly available by the individual concerned or by another person legally required to make it public.
The Act is therefore relevant not only to technology companies but also to e-commerce platforms, educational institutions, financial service providers, digital service operators and government bodies, subject to the law’s scope and applicable exemptions.
Important Definitions under the DPDP Act
1. Data Principal: The individual to whom personal data relates. For a child, the definition includes the child’s parent or lawful guardian in the circumstances specified by the Act.
2. Data Fiduciary: A person who, alone or together with others, determines the purpose and means of processing personal data. A business collecting customer information is a common example.
3. Data Processor: A person who processes personal data on behalf of a Data Fiduciary.
4. Consent Manager: A person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review and withdraw consent through an accessible and interoperable platform.
5. Personal Data: Data about an individual who is identifiable by or in relation to that data.
6. Data Protection Board of India: The statutory body established under the Act to perform specified functions relating to compliance, inquiries and enforcement.
Key Provisions of the DPDP Act, 2023
1. Consent and Notice
Consent is a central feature of the Act. Where consent is the applicable legal basis, it must be free, specific, informed, unconditional and unambiguous, expressed through a clear affirmative action.
Organisations must provide a notice explaining the personal data being processed and the purpose for processing it. Individuals should also be informed about how they can exercise their rights and withdraw consent.
Withdrawal of consent should be as easy as giving it. However, the Act also recognises certain legitimate uses for which consent is not the applicable basis.
2. Rights of Data Principals
The Act grants individuals several rights concerning their personal data:
- Right to access information: Individuals can seek information about personal data processed and obtain the prescribed information about its processing.
- Right to correction and erasure: Individuals can request correction, completion, updating and erasure of personal data, subject to legal requirements and applicable exceptions.
- Right to grievance redressal: Individuals can use the prescribed grievance mechanism and, where applicable, approach the Data Protection Board.
- Right to nominate: Individuals can nominate another person to exercise their rights in the event of death or incapacity, as provided by the Act.
These rights aim to give individuals greater control over how their digital personal data is handled.
3. Obligations of Data Fiduciaries
Data Fiduciaries must comply with the Act and applicable Rules. Their responsibilities include:
- Processing personal data for lawful purposes.
- Providing the required notice and obtaining valid consent where applicable.
- Implementing reasonable security safeguards to prevent personal data breaches.
- Notifying the Data Protection Board and affected individuals of personal data breaches in accordance with applicable requirements.
- Providing mechanisms for grievance redressal.
- Erasing personal data when the purpose has been fulfilled and retention is no longer necessary, subject to legal obligations and prescribed exceptions.
The Act makes organisations accountable for their handling of personal information rather than placing the entire burden of privacy protection on individuals.
4. Protection of Children’s Personal Data
Under the Act, a child is an individual below 18 years of age.
Data Fiduciaries are generally required to obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data, subject to the Act and applicable exemptions.
The Act also restricts specified activities involving children’s data, including tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exceptions.
These provisions are particularly significant in the context of social media platforms, online gaming, digital education and other services used by children.
5. Significant Data Fiduciaries
The Central Government may classify certain organisations as Significant Data Fiduciaries based on factors such as the volume and sensitivity of personal data processed, risks to individuals’ rights, potential effects on India’s sovereignty and integrity, and other prescribed considerations.
Significant Data Fiduciaries are subject to additional obligations. These may include appointing a Data Protection Officer based in India, appointing an independent data auditor, undertaking data protection impact assessments and conducting prescribed audits.
The objective is to apply stronger oversight to organisations whose data-processing activities may create greater risks.
6. Data Protection Board of India
The Act provides for the establishment of the Data Protection Board of India.
Its functions include examining matters relating to personal data breaches, conducting inquiries into specified contraventions, issuing directions and imposing monetary penalties in accordance with the law.
The Act also provides for an appeal mechanism to the Appellate Tribunal, identified as the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
The Board is an important institution for enforcing data protection obligations and addressing violations of the Act.
7. Cross-Border Transfer of Personal Data
The Act adopts a framework under which personal data may generally be transferred outside India, subject to restrictions that the Central Government may impose on transfers to specified countries or territories and to other applicable Indian laws.
This approach is important for multinational businesses, cloud services and digital platforms that operate across national boundaries.
Penalties under the DPDP Act, 2023
The Act provides for substantial monetary penalties for specified contraventions. The amount depends on the nature and seriousness of the violation and the applicable statutory schedule.
| Nature of contravention | Maximum monetary penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Up to ₹250 crore |
| Failure to notify the Board or affected individuals of a personal data breach, as required | Up to ₹200 crore |
| Non-fulfilment of obligations relating to children’s personal data | Up to ₹200 crore |
| Non-fulfilment of additional obligations by a Significant Data Fiduciary | Up to ₹150 crore |
| Other specified contraventions of the Act | Up to ₹50 crore |
These are statutory maximums, not automatic fines for every violation. The applicable provisions and circumstances determine the penalty.
Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 to provide the detailed framework for implementing the Act. They address matters such as notices, consent, children’s data, security safeguards, personal data breach notifications, retention and compliance obligations.
The Act and Rules have a phased implementation timeline. Some provisions commenced upon notification in November 2025, certain provisions are scheduled to commence after one year, and many substantive obligations are scheduled to commence after eighteen months. Therefore, it is important not to assume that every obligation became enforceable immediately upon notification.
Significance of the DPDP Act for India
The DPDP Act has several implications for governance, society and the economy.
First, it strengthens privacy protection. It establishes statutory rights and responsibilities for digital personal data processing.
Second, it improves accountability. Organisations are expected to implement safeguards and follow legal requirements while processing personal information.
Third, it supports the digital economy. A clearer legal framework can help build public trust in digital payments, online services, e-commerce and digital governance.
Fourth, it strengthens child protection. Specific safeguards address the risks associated with children’s digital data.
Fifth, it creates compliance challenges. Businesses and public institutions may need to revise consent mechanisms, data-retention practices, security systems and grievance-redressal procedures.
The Act must also be understood in the wider context of balancing privacy with freedom of expression, access to information, national security, innovation and the public interest.
Challenges and Concerns
Despite its significance, the Act raises several implementation questions:
- Privacy and transparency: The relationship between personal data protection and public access to information requires careful application of the law.
- Compliance costs: Smaller businesses and educational institutions may face costs in updating their data-processing systems.
- Enforcement capacity: Effective implementation requires adequate institutional capacity, technical expertise and accessible grievance mechanisms.
- Digital awareness: Individuals need to understand their rights, consent choices and available remedies.
- Balancing competing interests: Data protection measures must be implemented consistently with constitutional principles and other applicable laws.
The effectiveness of the framework will depend not only on legislation but also on institutional capacity, public awareness and meaningful compliance.
Digital Personal Data Protection Act, 2023: Important Facts for Exams
- Full name: Digital Personal Data Protection Act, 2023.
- Act number: Act No. 22 of 2023.
- Presidential assent: 11 August 2023.
- Implementing rules: Digital Personal Data Protection Rules, 2025, notified in November 2025.
- Constitutional background: Right to Privacy recognised as a fundamental right in Justice K.S. Puttaswamy v. Union of India (2017).
- Child under the Act: An individual below 18 years of age.
- Key terms: Data Principal, Data Fiduciary, Data Processor and Consent Manager.
- Regulatory institution: Data Protection Board of India.
- Appellate forum: TDSAT.
- Maximum penalty for failure to maintain reasonable security safeguards: Up to ₹250 crore.
- Implementation: Different provisions have different commencement dates; check the relevant notification when answering questions on enforcement.
- Exam relevance: Fundamental Rights, Right to Privacy, Governance, Cybersecurity, Digital India and data protection.
Read Here: Right to Information Act, 2005
Digital Personal Data Protection Act, 2023: FAQs
It is an Indian law that establishes a framework for protecting digital personal data while permitting its lawful processing. It defines the rights and duties of individuals and the obligations of organisations handling personal data.
The DPDP Act received the President’s assent on 11 August 2023.
The Board performs statutory functions relating to inquiries into specified contraventions, enforcement and monetary penalties under the Act.
The Act provides for a maximum monetary penalty of ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Other contraventions have different prescribed maximum penalties.
Yes. The Act defines a child as an individual below 18 years and generally requires verifiable parental or guardian consent for processing a child’s personal data, subject to applicable exemptions and rules.
