The Digital Personal Data Protection Act, 2023, Explained

India’s Digital Personal Data Protection Act, 2023 (DPDPA) is a landmark data-protection law. This explainer introduces it in general terms. It is educational information, not legal advice.

What the DPDPA is

The Digital Personal Data Protection Act, 2023 is India’s dedicated law on the processing of digital personal data. It establishes a framework of obligations for those who process personal data and rights for the individuals whose data is processed, replacing the earlier patchwork of provisions with a single, purpose-built statute.

Key concepts

• Data Principal — the individual to whom the personal data relates.
• Data Fiduciary — the entity that determines the purpose and means of processing personal data (broadly similar to a “controller” in other regimes).
• Consent — a central basis for processing, which must generally be free, specific, informed, and unambiguous, with certain legitimate uses recognised as well.
• Data Protection Board of India — the body established to address non-compliance and grievances.

Rights and obligations

The Act gives individuals rights in relation to their personal data — such as access, correction, and erasure, and grievance redressal — and places obligations on data fiduciaries around notice, consent, security safeguards, and reporting. It also contemplates additional duties for “significant data fiduciaries” and includes provisions relevant to the personal data of children.

Why it matters

The DPDPA affects almost every organisation that handles personal data in India, from large platforms to small businesses and publications. Its detailed operation depends significantly on rules framed under the Act, so following the rule-making and enforcement is essential to understanding how it works in practice. We cover developments in our Legislation & Policy vertical.

Frequently asked questions

What does the DPDPA regulate?

The processing of digital personal data in India, setting out obligations for data fiduciaries and rights for individuals (data principals).

Who enforces the DPDPA?

The Data Protection Board of India, established under the Act, addresses non-compliance and grievances.

Does the DPDPA give individuals rights over their data?

Yes — including rights of access, correction, and erasure, and to grievance redressal, subject to the conditions in the Act.