The DPDP Act, 2023 explained in plain English

The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data: any data about an individual who can be identified by or in relation to it (section 2(t)), in digital form (section 2(n)). “Processing” covers almost anything done to the data, from collection and storage to sharing and erasure (section 2(x)).

Under section 3, the Act applies to:

• processing of digital personal data within India, whether it was collected digitally or collected on paper and digitised later;
• processing outside India, if it is connected with offering goods or services to Data Principals within India. A foreign app or online shop selling to people in India is covered.

It does not apply to:

• personal data an individual processes for a personal or domestic purpose;
• personal data made publicly available by the person it relates to, or by someone legally required to publish it.

The Act applies in addition to other laws and prevails where they conflict (section 38). From 13 May 2027 it omits section 43A of the Information Technology Act, 2000 (section 44(2)), the same date its duties on businesses and its penalties come into force (see commencement below).

“Person” is defined broadly in section 2(s): individuals, Hindu undivided families, companies, firms, associations, the State and every other artificial juristic person. A sole proprietor can be a Data Fiduciary.

Section 4 allows processing only for a lawful purpose, meaning any purpose not expressly forbidden by law, and only on one of two grounds: the Data Principal’s consent, or a “certain legitimate use” under section 7.

Consent (section 6) and notice (section 5)

• Consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the data necessary for the specified purpose (section 6(1)).
• Any part of a consent that breaks the Act or another law is invalid to that extent (section 6(2)).
• Every request for consent must come with or after a notice saying what data is processed and why, how to exercise rights and how to complain to the Board (section 5(1)).
• The notice and the consent request must be available in English or any language in the Eighth Schedule to the Constitution (sections 5(3) and 6(3)).
• Withdrawing consent must be as easy as giving it (section 6(4)); the Data Fiduciary must then stop processing, and make its Data Processors stop, within a reasonable time (section 6(6)).
• If consent is challenged, the Data Fiduciary must prove the notice and consent (section 6(10)).
• For data collected with consent before the Act commenced, the Data Fiduciary must send a notice as soon as reasonably practicable (section 5(2)).

Certain legitimate uses (section 7)

Consent is not needed where processing is:

• for a purpose the Data Principal voluntarily gave the data for, where she has not said she does not consent (section 7(a));
• by the State for prescribed subsidies, benefits, services, certificates, licences or permits, or for its functions under law (sections 7(b) and 7(c));
• to meet a legal duty to disclose information to the State, or to comply with a judgment, decree or order (sections 7(d) and 7(e));
• to respond to a medical emergency, give treatment during an epidemic, or help people during a disaster or breakdown of public order (sections 7(f) to 7(h));
• for employment purposes, or to protect the employer from loss or liability (section 7(i)).

Section 8 sets the general obligations that apply to every Data Fiduciary:

What extra rules apply to children’s data? (section 9)

Before processing the personal data of a child, or of a person with disability who has a lawful guardian, a Data Fiduciary must get verifiable consent from the parent or guardian (section 9(1)). It must not process a child’s data in a way likely to harm the child’s well-being (section 9(2)), and must not track, behaviourally monitor or target advertising at children (section 9(3)). The Government can exempt classes of Data Fiduciaries or purposes from sections 9(1) and 9(3) (section 9(4)); the Rules do this in the Fourth Schedule.

What is a Significant Data Fiduciary? (section 10)

The Central Government can notify a Data Fiduciary or class as a Significant Data Fiduciary, weighing factors such as the volume and sensitivity of data, risk to Data Principals’ rights, sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. A Significant Data Fiduciary must appoint a Data Protection Officer based in India and responsible to its board, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits.

What duties do Data Principals have? (section 15)

The Act also places duties on individuals: follow applicable laws when exercising rights, do not impersonate anyone, do not suppress material information when providing data for State-issued documents or identifiers, do not register false or frivolous complaints, and give only verifiably authentic information when asking for correction or erasure. Breaching these duties can draw a penalty of up to ₹10,000.

Can personal data be sent outside India? (section 16)

Yes, by default. The Central Government may, by notification, restrict transfers to specific countries or territories, and any other Indian law that gives a higher degree of protection or restricts transfers continues to apply.

Section 17(1) switches off most of Chapter II (except sections 8(1) and 8(5)), Chapter III and section 16 where processing is needed to enforce a legal right or claim; by courts, tribunals and regulators performing their functions; to prevent, detect, investigate or prosecute offences; for data of people outside India processed under a contract with a foreign person; for an approved merger, demerger or similar scheme; or to ascertain the financial information and assets of a loan defaulter.

Further exemptions:

• Notified State instrumentalities, in the interests of sovereignty, security of the State and public order, are outside the Act (section 17(2)(a)).
• Research, archiving and statistical processing is outside the Act if no decision specific to a Data Principal is taken and prescribed standards are followed (section 17(2)(b)).
• The Government may exempt notified Data Fiduciaries, including startups, from section 5, sections 8(3) and 8(7), and sections 10 and 11 (section 17(3)).
• Within five years of commencement, the Government may declare any provision inapplicable to notified Data Fiduciaries for a set period (section 17(5)).

The Data Protection Board of India is the body the Act sets up to enforce it (section 18). It has a Chairperson and Members appointed by the Central Government, at least one of them a legal expert (section 19), each serving a two-year term that can be renewed (section 20).

• It acts on breach intimations, complaints from Data Principals, and references from the Central or a State Government or directions of a court; it can direct urgent remedial measures, inquire and impose penalties (section 27).
• It works as an independent body and, as far as practicable, as a digital office, with the powers of a civil court for summons, evidence and inspection (section 28).
• It can send a dispute to mediation (section 31) and accept a voluntary undertaking, which bars further proceedings on its contents (section 32).
• Appeals against its orders go to the Telecom Disputes Settlement and Appellate Tribunal within sixty days (section 29).

Read more on the Data Protection Board.

Section 1(2) lets the Government bring different provisions into force on different dates. It did so by G.S.R. 843(E), published on 13 November 2025 (Act commencement notification). The same day, the DPDP Rules, 2025 (G.S.R. 846(E)) were published, and their Rule 1 follows the same three steps (PIB release). Many of the Act’s duties work “in such manner as may be prescribed”, so the Rules matter as much as the Act.

Put plainly: a business’s duties under the Act, and the penalties for breaching them, apply from 13 May 2027.

See each rule in detail on the DPDP Rules, 2025 page, or work through the DPDP compliance checklist.

The DPDP Compliance Suite is planned around the Act’s core duties:

• A personal-data inventory, the starting point for sections 5, 8 and 11.
• A notice builder for section 5 notices in English and Eighth Schedule languages.
• Consent capture and records, with withdrawal as easy as giving consent (section 6).
• Data Principal rights requests with response-time tracking (sections 11 to 14).
• A breach response workflow for section 8(6) intimations.
• A verifiable parental consent workflow for section 9.

Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Meanwhile, try the free DPDP compliance checker.

General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.