Digital Personal Data Protection Act

Norm
Norm title	Digital Personal Data Protection Act, 2023
Type of norm	Act
Issuing body	Parliament of India
Geographic scope	National
Country	India
Status	Active
Official text	https://egazette.gov.in/WriteReadData/2023/247847.pdf
Related Norms	White Paper of the Committee of Experts on a Data Protection Framework for India (2017) A Free and Fair Digital Economy – Srikrishna Committee Report (2018) Personal Data Protection Bill, 2019 Information Technology Act, 2000 (SPDI Rules, 2011)
Parent legal framework	Indian data protection legal framework
Language	English

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s principal data-protection statute. It governs the processing of digital personal data (including data collected offline that is later digitized), defines obligations for data fiduciaries and rights/duties for data principals, provides for monetary penalties, and establishes the Data Protection Board of India as an adjudicatory body.

Scope and applicability

The act applies to processing of digital personal data in India, and to processing outside India when offering goods or services in India.

Key concepts and rights

• Data principals: individuals have rights to access information, correction and erasure, grievance redress, and to nominate another person to act on their behalf in case of death or incapacity.
• Data fiduciaries: entities processing personal data must implement reasonable security safeguards, give notices and obtain valid consent, and observe purpose/collection limitations. Certain legitimate-use grounds are specified in the Act.
• Consent managers: entities registered with the Board that enable individuals to give, manage, review, and withdraw consent through an interoperable platform.

Cross-border transfers

Cross-border transfers are permitted by default, except to countries or territories that the Central Government may restrict by notification (“negative list” approach). The Act does not impose a GDPR-style transfer mechanism by itself.

Institutional design

The Act provides for a Data Protection Board of India (Section 18) to adjudicate non-compliance, direct remedial measures (including on breach), and impose penalties.

Enforcement and penalties

The Schedule to the Act sets maximum penalties, including up to ₹250 crore for failure to implement reasonable security safeguards that lead to a personal-data breach, and up to ₹200 crore for failures such as breach notification or children’s-data obligations. A residual category covers “any other” contraventions up to ₹50 crore. A separate small penalty applies to data principals for specified misuse.

Status and implementation

On January 3, 2025, MeitY released the Draft Digital Personal Data Protection Rules, 2025 for public consultation; as of mid-2025, substantive provisions of the Act were widely described as pending notification and phased rollout was expected following final Rules. MeitY reported receiving 6,915 submissions on the draft Rules on July 26, 2025.

History

• November 27, 2017 – Committee of Experts (Justice B.N. Srikrishna, Chair) releases a White Paper to solicit public comments on a data-protection framework.
• July 27, 2018 – Committee submits report A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians and a draft Personal Data Protection Bill, 2018 to MeitY.
• December 11, 2019 – Government introduces the Personal Data Protection Bill, 2019 in Lok Sabha; referred to a Joint Parliamentary Committee (report: December 16, 2021).
• August 3, 2022 – Government withdraws the 2019 Bill to reconsider the framework.
• August 11, 2023 – Parliament enacts the Digital Personal Data Protection Act, 2023.