DPDPA 2023 — Complete Guide

Introduction

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s principal statutory framework for the processing of digital personal data. The Act received Presidential assent on 11 August 2023 and is designed to recognise an individual’s right to protect personal data while also permitting lawful processing of personal data for legitimate purposes.

The framework introduces a rights-and-obligations model built around two central participants: the Data Principal, whose personal data is processed, and the Data Fiduciary, which determines the purpose and means of processing personal data.

The statutory framework is supported by the Digital Personal Data Protection Rules, 2025. The Rules provide operational details around areas such as notices, consent management, security safeguards, breach notifications, children's data and other implementation requirements.

What is the DPDPA?

The DPDP Act establishes a legal framework for processing digital personal data in India. Rather than treating privacy only as a technical security issue, the framework connects data processing with transparency, lawful purposes, individual rights, organisational accountability and regulatory enforcement.

In practical terms, an organisation should be able to answer four fundamental questions about every significant personal-data processing activity:

1. What personal data are we processing?
2. Why are we processing it?
3. On what legal basis or permitted ground are we processing it?
4. What controls exist to protect the data and respect Data Principal rights?

Scope and Applicability

The DPDP Act applies to the processing of digital personal data within the territory of India where the processing is carried out in connection with an activity of offering goods or services to Data Principals within India.

The Act can also apply to processing outside India where such processing is in connection with offering goods or services to Data Principals within India, subject to the statutory framework and applicable conditions.

The scope should not be interpreted as meaning that every piece of information held by an organisation is automatically regulated. The framework is concerned with digital personal data, and the Act contains specific exclusions and conditions that need to be considered during applicability analysis.

Practical applicability test

Before beginning a compliance project, organisations should map their activities across websites, mobile applications, SaaS products, customer databases, HR systems, marketing platforms, support tools, analytics systems and third-party processors.

Key Definitions

Understanding the statutory terminology is essential because compliance obligations depend heavily on the role an organisation performs.

Data Principal

A Data Principal is the individual to whom the personal data relates. In the case of a child, the term includes the parent or lawful guardian in the manner recognised by the Act.

Data Fiduciary

A Data Fiduciary is the person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.

Data Processor

A Data Processor processes personal data on behalf of a Data Fiduciary. Common examples can include cloud service providers, customer-support platforms, payroll platforms, analytics vendors and other technology providers, depending on the contractual and operational arrangement.

Personal Data

Personal data means any data about an individual who is identifiable by or in relation to such data.

Processing

Processing covers operations performed on digital personal data, including collection, storage, use, sharing, disclosure, dissemination, erasure and other forms of handling.

Grounds for Processing Personal Data

The DPDP framework does not reduce lawful processing to a single consent checkbox. The Act recognises consent as a principal ground while also providing for certain legitimate uses in specified circumstances.

This distinction is important for compliance teams. Every processing activity should be mapped to the applicable statutory basis or permitted ground rather than assuming that collecting consent is always the only possible route.

Consent-based processing

Where processing is based on consent, the organisation should ensure that the consent mechanism meets the statutory requirements and that the user is given appropriate information before consent is obtained.

Legitimate uses

The Act specifies circumstances in which personal data may be processed for certain legitimate uses. These provisions should be assessed against the exact facts and applicable statutory conditions rather than being treated as a broad general-purpose exception.

Consent Framework

Consent under the DPDP Act must be free, specific, informed and unambiguous, with a clear affirmative action. The request for consent should be presented in a manner that makes it reasonably understandable to the Data Principal.

Consent should not be hidden inside unrelated terms or obtained through interfaces that make the user's choice unclear.

Good consent design

• Use clear and understandable language.
• Identify the purpose for which personal data is being processed.
• Avoid confusing or deceptive interface patterns.
• Maintain evidence of consent where appropriate.
• Provide a practical mechanism for withdrawal.
• Ensure withdrawal is not unnecessarily difficult compared with giving consent.

Consent lifecycle

Organisations should think of consent as a lifecycle rather than a one-time database field:

1. Present the appropriate notice.
2. Obtain consent where required.
3. Record the consent event.
4. Associate consent with the relevant purpose.
5. Allow withdrawal through an appropriate mechanism.
6. Propagate withdrawal to downstream processing systems where applicable.

Notice Requirements

Notice is a foundational transparency mechanism under the DPDP framework. The Data Principal should receive information necessary to understand what personal data is being processed and the purpose of the processing.

The Digital Personal Data Protection Rules, 2025 provide additional requirements around the structure and content of notices. The Rules require the notice to be presented independently and in clear and plain language, including an itemised description of the personal data and the specified purpose or purposes of processing.

What a strong privacy notice should achieve

• Explain what data is collected.
• Explain why the data is required.
• Clearly distinguish different purposes where appropriate.
• Explain how the Data Principal can exercise applicable rights.
• Provide appropriate mechanisms for consent withdrawal and grievance handling.

Legitimate Uses

The DPDP Act provides for processing in specified legitimate-use situations. Examples recognised by the statutory framework include certain situations involving voluntary provision of personal data, performance of functions under law, provision of services or benefits by the State, compliance with legal obligations and other circumstances specifically described by the Act.

Organisations should document the exact provision relied upon and the facts that support its application. A generic statement such as “legitimate interest” should not be used as a substitute for the specific statutory framework under the DPDP Act.

Data Principal Rights

The DPDP Act gives Data Principals specific rights in relation to their personal data. Organisations should build operational processes so that these rights can be received, verified, routed, tracked and resolved.

// Ye paragraph add karo:

For a deeper dive into director liabilities regarding these rights, read our DPDP Act Director Liability Insight.

Right to information about personal data and processing

Data Principals have rights to obtain information regarding their personal data and processing activities as provided by the Act.

Right to correction and erasure

Data Principals can request correction of inaccurate or misleading personal data and erasure of personal data where applicable, subject to the statutory framework.

Right to grievance redressal

Organisations should establish a clear grievance mechanism and ensure that complaints can be routed to the appropriate person or function within the organisation.

Right to nominate

The Act provides a right to nominate another individual in accordance with the statutory framework.

Duties of Data Principals

The DPDP Act does not place responsibilities only on organisations. Data Principals also have statutory duties, including providing information that is authentic in certain circumstances and complying with applicable legal requirements while exercising rights under the framework.

For organisations, this means that rights-management workflows should be designed to handle legitimate requests while maintaining appropriate safeguards against misuse or fraudulent requests.

Data Fiduciary Obligations

Data Fiduciaries carry the central operational responsibility under the DPDP framework. Their obligations extend beyond publishing a privacy policy.

Core organisational responsibilities

• Process personal data in accordance with the applicable legal framework.
• Provide appropriate notice.
• Obtain valid consent where consent is the applicable ground.
• Maintain appropriate security safeguards.
• Take reasonable steps to ensure completeness, accuracy and consistency where required.
• Implement mechanisms for Data Principal rights.
• Handle personal data breaches according to applicable requirements.
• Delete personal data when retention is no longer required, subject to applicable obligations.
• Maintain appropriate governance over Data Processors.

Vendor governance

Organisations should not assume that outsourcing processing transfers their compliance responsibility. Contracts and operational controls should clearly define processing purposes, security responsibilities, incident escalation, deletion, access controls, audit support and other relevant requirements.

Security Safeguards

Security is a core component of DPDP compliance. Organisations should implement reasonable security safeguards appropriate to the nature of the processing and associated risks.

Practical control areas

• Access control and least privilege.
• Authentication and privileged-access management.
• Encryption and appropriate protection of data.
• Logging and monitoring.
• Backup and recovery controls.
• Vulnerability and patch management.
• Security testing.
• Incident response procedures.
• Employee awareness and security training.
• Third-party security governance.

The 2025 Rules provide additional detail regarding reasonable security safeguards, including measures relating to encryption, access controls, logging, monitoring, backups and organisational security practices.

Personal Data Breach Management

A personal data breach should be treated as a governance and incident-response event, not merely as an IT ticket.

// Ye paragraph add karo:

To see how real organisations handle these incidents, read our Healthcare Data Breach Case Study.

Organisations should maintain a documented process for identifying, containing, assessing, escalating and reporting personal data breaches in accordance with the applicable provisions and commencement timeline.

Recommended breach workflow

1. Detect and record the incident.
2. Contain the affected systems or access path.
3. Identify the categories of personal data involved.
4. Assess affected Data Principals and potential impact.
5. Escalate internally to privacy, security and legal stakeholders.
6. Determine applicable notification obligations.
7. Maintain evidence of decisions and actions.
8. Complete remediation and lessons learned.

Retention, Erasure and Data Lifecycle

Privacy compliance should include a defined lifecycle for personal data. Keeping information indefinitely simply because storage is inexpensive creates unnecessary privacy, security and governance risk.

Data lifecycle model

1. Collection
2. Use
3. Sharing or disclosure where permitted
4. Archival where justified
5. Deletion or secure disposal

Organisations should maintain retention schedules that connect categories of data with business purpose, statutory retention requirements, contractual requirements and deletion mechanisms.

Children's Personal Data

The DPDP Act provides enhanced protections for the personal data of children. Under the statutory framework, a child is an individual who has not completed eighteen years of age.

Processing children's personal data is subject to additional requirements, including obtaining verifiable consent from the parent or lawful guardian in the circumstances specified by the Act and Rules.

Additional controls to consider

• Age determination or age-related controls where required.
• Verifiable parental consent mechanisms.
• Restrictions on harmful processing practices.
• Controls around behavioural monitoring and targeted advertising where applicable.
• Evidence and auditability of parental consent.

Significant Data Fiduciaries

The Act creates a special category of Significant Data Fiduciary (SDF). The Central Government may notify an organisation as an SDF based on factors recognised by the Act, including the volume and sensitivity of personal data, risk to the sovereignty and integrity of India, risk to electoral democracy, security of the State, public order and other relevant factors.

SDFs are subject to additional governance requirements. Depending on the applicable provisions and rules, these can include appointment of a Data Protection Officer, appointment of an independent data auditor and undertaking specified assessments and audits.

Why SDF classification matters

Organisations that may fall within the SDF framework should build stronger governance capabilities early rather than waiting for formal designation before establishing privacy leadership, auditability and risk-management processes.

Cross-Border Data Transfers

The DPDP Act does not create a blanket prohibition on international transfers of personal data. Instead, the Central Government may restrict transfers of personal data outside India to such countries or territories as may be specified by notification.

Organisations should therefore maintain visibility into where personal data is stored, accessed and processed, including through cloud providers, SaaS vendors, support teams and group companies.

Cross-border assessment checklist

• Identify countries where data is stored.
• Identify countries from which personnel can access the data.
• Map international vendors and subprocessors.
• Review contractual protections.
• Monitor applicable government notifications and restrictions.
• Document the organisation's transfer governance process.

Consent Managers

The DPDP framework introduces the concept of a Consent Manager. A Consent Manager is intended to provide a structured mechanism through which a Data Principal can give, manage, review and withdraw consent.

The 2025 Rules prescribe requirements relating to registration and operation of Consent Managers, including organisational capability, interoperable technology, records of consent and data sharing, security, transparency and conflict-of-interest controls.

Organisations integrating with a Consent Manager should evaluate the contractual, technical and governance implications of that integration rather than treating it as simply another API integration.

Grievance Redressal

A privacy programme should provide a clear and accessible route for Data Principals to raise grievances.

Recommended grievance workflow

1. Receive the grievance through an identified channel.
2. Generate a unique case or ticket reference.
3. Verify and classify the request where appropriate.
4. Assign the responsible internal owner.
5. Investigate the underlying processing activity.
6. Respond within the applicable timeline.
7. Maintain evidence of the response and closure.

Data Protection Board of India

The DPDP Act establishes the Data Protection Board of India as the regulatory body responsible for exercising powers and performing functions assigned under the Act.

The Government notified the establishment of the Data Protection Board of India as part of the DPDP implementation framework in November 2025.

Organisations should therefore treat regulatory readiness as an ongoing governance function. Policies, evidence, incident records, consent records, contracts and rights-request records should be maintained in a form that can support regulatory engagement where required.

Penalties and Enforcement

The DPDP Act provides for financial penalties for specified contraventions. The Schedule to the Act establishes different maximum penalty amounts for different categories of breach.

The maximum penalty under the Schedule can reach ₹250 crore for specified contraventions. This should not be interpreted as a universal flat penalty for every privacy violation. The applicable amount depends on the nature of the contravention and the statutory framework.

Compliance lesson

Penalty exposure should not be the only reason to implement privacy controls. Organisations should also consider operational disruption, customer trust, contractual exposure, regulatory scrutiny, incident response costs and reputational impact.

Commencement and 2025 Rules Timeline

One of the most important aspects of implementing the DPDP framework is understanding the commencement timeline. The Act does not make every provision effective on the same date.

The Central Government's commencement notification dated 13 November 2025 established a phased implementation model. Certain provisions came into force immediately, some provisions were scheduled for one year later, and the main operational provisions were scheduled for eighteen months after publication of the notification.

Because commencement dates are legally significant, organisations should always verify the latest Government notifications before treating a particular obligation as currently enforceable.

DPDPA Compliance Checklist

A practical compliance programme should translate statutory requirements into measurable controls.

1. Governance

• Assign privacy ownership.
• Define responsibilities across legal, security, product and engineering teams.
• Maintain privacy policies and internal procedures.
• Establish escalation and decision-making processes.

2. Data Inventory

• Identify personal-data categories.
• Identify Data Principals.
• Document purposes of processing.
• Map systems, applications and databases.
• Identify Data Processors and subprocessors.

3. Notice and Consent

• Review existing privacy notices.
• Map notices to processing purposes.
• Review consent collection interfaces.
• Implement consent evidence and withdrawal mechanisms.

4. Data Principal Rights

• Build request intake mechanisms.
• Define verification procedures.
• Define internal ownership and escalation.
• Track requests and responses.
• Maintain evidence of closure.

5. Security

• Review access controls.
• Review encryption and key management.
• Review logging and monitoring.
• Review incident response.
• Assess vendor security controls.

6. Data Lifecycle

• Define retention periods.
• Identify deletion triggers.
• Automate deletion where feasible.
• Review backups and archived data.

7. Third-Party Governance

• Maintain a processor inventory.
• Review data-processing contracts.
• Map subprocessors.
• Define incident notification requirements.
• Review international processing locations.

Practical Implementation Roadmap

Organisations should avoid trying to solve DPDP compliance by writing a single privacy policy. A stronger approach is to implement the programme in stages.

DPDPA and GDPR — High-Level Difference

Organisations operating across India and the European Union should not assume that GDPR compliance automatically means DPDP compliance. Although both frameworks focus on personal-data protection, their structures, terminology, legal mechanisms, regulatory approaches and detailed obligations differ.

A multinational organisation should therefore perform a jurisdiction-by-jurisdiction assessment instead of copying one privacy compliance programme across every market.

Frequently Asked Questions

Is the DPDPA only applicable to Indian companies?

No. Applicability depends on the statutory scope and the nature of processing, including certain processing outside India connected with offering goods or services to Data Principals in India.

Is consent required for every processing activity?

No. The Act provides for consent as well as specified legitimate uses. The applicable ground should be identified for each processing activity based on the facts and statutory requirements.

Does having a privacy policy mean an organisation is DPDP compliant?

No. A privacy policy is only one component of a broader compliance programme. Organisations also need appropriate governance, security, rights handling, vendor controls, data lifecycle management and operational evidence.

Does DPDP prohibit cross-border data transfers?

The Act does not establish a blanket prohibition on international transfers. Organisations must monitor the applicable framework and any restrictions notified by the Central Government.

Is every organisation a Significant Data Fiduciary?

No. Significant Data Fiduciary status is a specific statutory classification and depends on the criteria and notification framework under the Act.

Can DPDP compliance be automated?

Technology can significantly improve compliance operations by automating data discovery, consent records, rights requests, retention workflows, vendor tracking, risk assessments and evidence collection. However, automation does not replace legal interpretation, governance or accountability.

Conclusion

The DPDP framework represents a major shift toward structured privacy governance for organisations processing digital personal data in India. The strongest compliance programmes will not treat the Act as a documentation exercise. Instead, privacy requirements should be connected directly to product design, engineering, information security, vendor management, customer operations and corporate governance.

For most organisations, the practical starting point is straightforward: discover the data, understand the purpose, identify the applicable legal ground, establish transparency, protect the data, enable Data Principal rights, control vendors, manage the lifecycle and maintain evidence.

Official References