Key Provisions of the DPDP Act 2023
The Digital Personal Data Protection Act, 2023 is a 44-section, 6-chapter legislation that fundamentally reshapes how personal data is processed in India. This page provides a chapter-wise overview, key definitions, a section-wise mapping, and a brief history of the Act. Whether you are a lawyer, compliance professional, or business owner, this is your starting point for understanding the statute.
The 6 Chapters at a Glance
Chapter I: Preliminary
Sections 1-3Short title, extent, commencement, and definitions. This chapter sets the foundation � defining who a Data Principal is, who a Data Fiduciary is, what "personal data" means, and other critical terms.
Chapter II: Obligations & Rights
Sections 4-14The heart of the Act. Covers lawful processing, notice, consent, legitimate uses, general obligations of Data Fiduciaries, children's data, SDF obligations, and the rights of Data Principals.
Chapter III: Cross-Border Transfer
Section 15Provisions for transfer of personal data outside India. Empowers the government to restrict transfers to notified countries and sets conditions for international data flows.
Chapter IV: Data Protection Board
Sections 16-27Establishes the Data Protection Board of India � the regulatory authority. Covers composition, appointment, powers, functions, procedure, and the appeal mechanism to TDSAT.
Chapter V: Penalties & Adjudication
Sections 28-34Covers the procedure for imposing penalties, factors to be considered, and the Schedule of penalties (up to ?250 crore). This is where enforcement power is operationalised.
Chapter VI: Miscellaneous
Sections 35-44Covers miscellaneous provisions � protections for state functions, exemptions, power to make rules, removal of difficulties, and transitional provisions.
1. The Structure of the Act
The DPDP Act 2023 is a compact but powerful legislation. At 44 sections, it is shorter than the GDPR (99 articles) but covers similar ground � rights, obligations, enforcement, and penalties. The Act is supplemented by a Schedule (penalties) and will be further operationalised by Rules that will be notified by the Central Government.
The structure is logical: Chapter I sets the foundation (definitions), Chapter II creates the rights and obligations, Chapter III handles cross-border transfers, Chapter IV creates the enforcement authority, Chapter V sets penalties, and Chapter VI covers miscellaneous matters. This structure reflects the Act's philosophy � rights and obligations are at the centre, with enforcement and penalties as the backstop.
For businesses, Chapter II is the most operationally important � it defines the day-to-day obligations around notice, consent, security, breach notification, and grievance redressal. For Data Principals, Chapter II's rights provisions (Sections 11-14) are the most relevant. For lawyers and compliance professionals, all chapters matter.
2. Key Definitions (Chapter I)
The Act defines several critical terms in Section 2. Understanding these is essential because they determine the scope of the entire law. Here are the 8 most important definitions:
Data Principal
Section 2(j)The individual to whom the personal data relates. Also includes parents/guardians in case of children, and persons with disabilities in case of persons with disabilities.
Data Fiduciary
Section 2(i)Any person who alone or jointly with others determines the purpose and means of processing personal data. This includes most businesses, websites, apps, and service providers.
Data Processor
Section 2(k)Any person who processes personal data on behalf of a Data Fiduciary. Examples include cloud providers, payroll processors, and IT service providers.
Personal Data
Section 2(t)Any data about an individual who is identifiable by or in relation to such data. This includes names, emails, phone numbers, IP addresses, location data, and more.
Processing
Section 2(x)Any operation or set of operations performed on personal data � including collection, recording, storage, retrieval, use, sharing, and deletion.
Consent
Section 6Any freely given, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes, with a clear affirmative action.
Significant Data Fiduciary
Section 10A Data Fiduciary notified by the Central Government based on factors such as the volume and sensitivity of data processed, risk to Data Principals, and impact on national security.
Personal Data Breach
Section 2(u)Any unauthorised use, sharing, access, disclosure, alteration, destruction, or loss of personal data in the possession of a Data Fiduciary.
3. Section-Wise Map of the Act
Here is a section-wise map of the Act � a quick reference to what each part of the statute covers:
| Chapter | Sections | Title | What it Covers |
|---|---|---|---|
| I | 1-3 | Preliminary | Short title, extent, commencement, definitions |
| II | 4 | Grounds for Processing | Processing only for lawful purpose with consent or legitimate use |
| II | 5 | Notice | Notice requirements before obtaining consent |
| II | 6 | Consent | Consent must be free, specific, informed, unconditional, unambiguous |
| II | 7 | Legitimate Uses | Certain uses that do not require consent |
| II | 8 | General Obligations | Data Fiduciary obligations (security, breach notification, grievance redressal) |
| II | 9 | Children's Data | Verifiable parental consent; no behavioral tracking |
| II | 10 | Significant Data Fiduciary | Enhanced obligations for SDFs (DPO, audits, DPIA) |
| II | 11-14 | Rights of Data Principals | Access, correction, erasure, grievance redressal, portability, nomination |
| III | 15 | Cross-Border Transfer | Government may restrict transfers to notified countries |
| IV | 16-27 | Data Protection Board | Composition, powers, functions, procedure, appeals to TDSAT |
| V | 28-34 | Penalties & Adjudication | Procedure for imposing penalties; Schedule of penalties |
| VI | 35-44 | Miscellaneous | State functions, exemptions, rule-making, removal of difficulties |
4. Chapter-Wise Deep Dive
Here is a closer look at what each chapter contains and why it matters:
Chapter II � The Heart of the Act
Chapter II (Sections 4-14) is where the Act's substantive obligations and rights live. It covers:
- Section 4: Grounds for processing (consent or legitimate use)
- Section 5: Notice requirements before obtaining consent
- Section 6: Consent � free, specific, informed, unconditional, unambiguous
- Section 7: Legitimate uses (state functions, legal obligations, medical emergencies)
- Section 8: General obligations of Data Fiduciaries (security, breach notification, grievance redressal)
- Section 9: Children's data � verifiable parental consent, no behavioral tracking
- Section 10: Significant Data Fiduciary obligations (DPO, audits, DPIA)
- Sections 11-14: Rights of Data Principals (access, correction, erasure, grievance redressal, portability, nomination)
Chapter IV � The Enforcement Authority
Chapter IV (Sections 16-27) establishes the Data Protection Board of India. It covers:
- Section 18: Establishment of the Board
- Section 19: Composition and appointment of Chairperson and members
- Section 20: Removal of Chairperson and members
- Sections 21-27: Powers, functions, procedure, and appeal mechanism
Chapter V � The Penalty Framework
Chapter V (Sections 28-34) sets out the penalty framework. It covers:
- Section 28: Penalties for various violations
- Section 33: Factors to be considered when imposing penalties
- Section 34: Appeal to TDSAT
- Schedule: The actual penalty amounts (?50 crore to ?250 crore)
5. Legislative Timeline
The DPDP Act was years in the making. Here is a brief timeline of its evolution:
DPDP Act 2023 Receives Presidential Assent
The Digital Personal Data Protection Act, 2023 received presidential assent on 11 August 2023. This was the culmination of years of deliberation, including the Justice B.N. Srikrishna Committee report (2018) and multiple draft bills.
Draft Rules Released for Public Consultation
The Ministry of Electronics and Information Technology (MeitY) released draft rules under the DPDP Act for public consultation. Stakeholders submitted feedback on consent managers, breach notification timelines, and SDF criteria.
Phased Implementation of Rules
The Rules will be notified in phases. Some provisions (such as SDF obligations) may be implemented later to give organisations time to prepare. Full compliance is expected within 12-24 months of notification.
Operationalisation of the Data Protection Board
The Data Protection Board will be fully operationalised, with a Chairperson and members appointed, and the power to investigate complaints and impose penalties.
6. Why Understanding the Provisions Matters
For businesses, knowing the provisions is essential because the obligations in Chapter II are not vague principles � they are specific, enforceable requirements. A failure to provide proper notice, obtain valid consent, or implement reasonable security safeguards can attract penalties of up to ?250 crore. Compliance requires a thorough understanding of the statute.
For Data Principals, knowing your rights (Sections 11-14) empowers you to take action. You can request access, correction, or erasure; file grievances; and escalate complaints to the Data Protection Board if they are not resolved.
For lawyers and compliance professionals, the section-wise map is a useful starting point for legal research and drafting. The Act is new, and many provisions will be clarified through Rules, Board decisions, and judicial interpretation. Keeping track of these developments is essential for advising clients.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
How many chapters and sections are there in the DPDP Act 2023?+
The DPDP Act 2023 has 6 chapters and 44 sections. It also has a Schedule that sets out the penalties for various violations.
What is Chapter I of the DPDP Act?+
Chapter I (Sections 1-3) is the Preliminary chapter. It covers the short title, extent, commencement, and definitions � defining key terms like Data Principal, Data Fiduciary, and personal data.
What does Chapter II of the DPDP Act cover?+
Chapter II (Sections 4-14) covers the obligations of Data Fiduciaries and the rights of Data Principals. It includes provisions on lawful processing, notice, consent, children's data, SDF obligations, and rights.
What is Chapter III of the DPDP Act?+
Chapter III (Section 15) covers cross-border transfers. It empowers the government to restrict data transfers to notified countries, though the exact list has not yet been published.
What does Chapter IV of the DPDP Act establish?+
Chapter IV (Sections 16-27) establishes the Data Protection Board of India. It covers composition, appointment, powers, functions, procedure, and the appeal mechanism to TDSAT.
What is covered in Chapter V of the DPDP Act?+
Chapter V (Sections 28-34) covers penalties and adjudication. It includes the procedure for imposing penalties, factors to be considered, and the Schedule of penalties (up to ?250 crore).
What is the Schedule to the DPDP Act?+
The Schedule lists the penalties for various violations. The highest penalty is ?250 crore for failure to take reasonable security safeguards to prevent a personal data breach. The lowest is ?50 crore for general non-compliance.
When did the DPDP Act 2023 come into force?+
The Act received presidential assent on 11 August 2023. Different provisions will come into force in phases, as notified by the Central Government. The Rules are still being finalised.
Related Topics
Rights of Data Principals
Chapter II rights explained in detail.
Obligations of Data Fiduciaries
Chapter II obligations for businesses.
Data Protection Board
Chapter IV � the enforcement authority.
Penalties & Offences
Chapter V and the Schedule explained.
Cross-Border Transfer
Chapter III provisions in detail.
DPDPA Complete Guide
End-to-end guide to the Act.
Want to understand the Act end-to-end?
Take our free DPDPA assessment to see where your organisation stands, or dive into our comprehensive guide to the Act.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. The summary of provisions is not a substitute for the actual text of the Act. For advice on your specific situation, consult a qualified legal professional.