DPDP explained
The DPDP Act, in plain words
What India’s data protection law asks of your business, and what it means for the systems you run.
This page is general information, not legal advice. For advice on your situation, speak to a lawyer.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India’s law on personal data. It sets out how organisations may collect, use, store and share information about individuals, and the rights those individuals have. The DPDP Rules, 2025, notified on 13 November 2025, set out how it works in practice.
Does it apply to us?
Almost certainly, if you process digital information about people in India: customers, patients, students, farmers, employees or job applicants. It also covers paper records that are later digitised, and businesses outside India that offer goods or services to people in India.
It doesn’t cover personal or household use, or data a person has made public themselves (or that someone was legally required to publish).
Who’s who
How the parties relate, in one example
Ramesh is a farmer who orders seeds on AgriShop. AgriShop’s tech partner hosts and runs the app.
Data Principal
The person the data is about. They hold the rights. For a child, the parent acts for them.
Data Fiduciary
The business that decides what data to collect and why. It carries the duties, including for what its vendors do.
Data Processor
A company that handles data on the fiduciary’s instructions, under a contract.
Consent Manager
A platform registered with the Board where people can give, review and withdraw consent across services. Optional for businesses.
Data Protection Board
The regulator. It hears complaints, receives breach reports, orders fixes and imposes penalties.
Appellate Tribunal
The Telecom Disputes Settlement and Appellate Tribunal (TDSAT) hears appeals against the Board’s orders.
The duties
What the Act asks of a business
| Duty | In plain words | What it means for your systems |
|---|---|---|
| Notice | Before asking for consent, tell people in plain language what you collect and why, how to withdraw consent, how to exercise their rights and how to complain to the Board. The notice must be available in English or any language in the Eighth Schedule of the Constitution | Itemised notices shown in your app at the right moment, versioned, with working links for withdrawal and requests |
| Consent | Get free, specific, informed consent through a clear action, and make withdrawal as easy as giving it. If challenged, the business must prove it gave notice and got consent | Consent recorded per person and purpose; withdrawal that reaches every system |
| Purpose and retention | Use data only for the stated purpose; erase it when that purpose is served or consent is withdrawn, unless a law requires you to keep it | Retention rules and deletion jobs, including copies and backups |
| Accuracy | Keep data complete, accurate and consistent where it is used to make a decision about a person or shared with another business | Validation and correction flows, one source of truth |
| Rights | Let people see, correct and erase their data, and nominate someone to act for them; resolve grievances within 90 days | Request intake, identity checks and tracked responses |
| Security safeguards | Take reasonable steps to protect personal data, including data your vendors process, and keep logs for at least one year | Access control, encryption, masking, monitoring, backups, one-year logs |
| Breach reporting | Tell affected people and the Board without delay, and send the Board a detailed report within 72 hours. There is no minimum size: every breach counts | Detection, escalation and evidence ready before anything goes wrong |
| Vendors | Use processors only under a valid contract, with security clauses, and make sure they erase data when you must | A map of who receives data, and controls on what they get |
| Children’s data | Verifiable parental consent for anyone under 18; no tracking or targeted ads aimed at children | Age checks and parental consent flows |
| Contact | Publish the contact details of a person who can answer questions about how you process personal data | A contact on your website and app, and in every response to a request |
When consent isn’t needed
Nine legitimate uses
Consent is the main basis for processing personal data, but the Act lists cases where it isn’t needed. The other duties, such as security and erasure, still apply.
- Data a person gives you for a stated purpose, unless they object
- Government subsidies, benefits, services, licences and permits
- State functions, sovereignty and security
- A legal duty to disclose information to the State
- Complying with a court judgment or order
- A medical emergency threatening someone’s life or health
- Health services during an epidemic or public health threat
- Safety and help during a disaster or breakdown of public order
- Employment, and protecting the employer from loss or liability
People’s rights
What a Data Principal can ask for
Access
A summary of their personal data, how it is processed, and who it has been shared with.
Correction and erasure
Correct, complete or update their data, and have it erased where no law requires it to be kept.
Grievance redressal
A response from the business within 90 days. Only after that can they complain to the Board.
Nomination
Someone to exercise their rights if they die or can no longer act for themselves.
People have duties too: they must not impersonate anyone, file false or frivolous complaints, or give anything but genuine information when asking for corrections. Breaching these duties can attract a penalty of up to ₹10,000.
The largest data handlers
Significant Data Fiduciaries
The government can name a business a Significant Data Fiduciary because of the volume or sensitivity of its data, or the risks it poses. Most businesses won’t be one, but many supply one, and those requirements reach suppliers through contracts.
Extra duties
- Appoint a Data Protection Officer based in India, answerable to the board of directors
- Appoint an independent data auditor
- Carry out a Data Protection Impact Assessment and an audit every 12 months
- Check that algorithms don’t put people’s rights at risk
- Keep data the government specifies within India
The deadlines
When it applies
What’s at stake
Maximum penalties
| Breach | Up to |
|---|---|
| Failing to take reasonable security safeguards to prevent a breach | ₹250 crore |
| Failing to notify the Board or affected people of a breach | ₹200 crore |
| Breaching the additional duties for children | ₹200 crore |
| Breaching the additional duties of a Significant Data Fiduciary | ₹150 crore |
| Breaching a voluntary undertaking accepted by the Board | Up to the penalty for the original breach |
| Breaching any other provision of the Act or Rules | ₹50 crore |
| A Data Principal breaching their own duties | ₹10,000 |
The Board weighs how serious and how long the breach was, the data affected, whether it was repeated, and how well it was mitigated. Penalties go to the government; the Act doesn’t compensate affected individuals. For most businesses the nearer pressure is commercial: large customers are asking suppliers how they protect personal data.
Other rules worth knowing
Data abroad, exemptions and appeals
Data sent abroad
Allowed, except to countries the government restricts. Stricter sector rules, such as RBI’s payment data rules, still apply.
Exemptions
Some duties don’t apply in limited cases: legal claims, investigating offences, court-approved mergers, research under safeguards, and Indian firms processing data of people outside India for a foreign client. Security safeguards still apply.
The Board and appeals
The Board works online. It can order fixes, refer disputes to mediation, accept voluntary undertakings and impose penalties. Appeals go to TDSAT within 60 days.
Policies and notices matter, and your lawyers should own them. But almost every duty above ends in a change to an application, a database or a log. That is the part we do.
Readiness check
Not sure where you stand?
Ten minutes, twenty questions, an instant readiness score. No sign-up needed to see your result.