PrivacyLawHub

The Digital Personal Data Protection Act, 2023

Act No. 22 of 2023. Received Presidential assent on 11 August 2023. Provides for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes.

Overview

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's general law on digital personal data. Enacted by Parliament, it sets when a Data Fiduciary may process personal data (consent or certain legitimate uses), what notice it must give, its security and breach duties, special rules for children, the rights of Data Principals and penalties imposed by the Data Protection Board of India. This page lists every section and the Schedule with official text and commentary.

Key facts

Citation
Act No. 22 of 2023
Presidential assent
11 August 2023
Structure
44 sections in 10 chapters, plus one Schedule (penalties)
Regulator
Data Protection Board of India (Section 18)
Rules made under it
Digital Personal Data Protection Rules, 2025
Phased commencement
  • 13 November 2025: Section 1(2), Section 2, Sections 18–26, 35, 38–43, and Section 44(1) and (3)
  • 13 November 2026: Section 6(9) and Section 27(1)(d)
  • 13 May 2027: All remaining provisions

Contents

  1. Chapter I - Preliminary3 provisions
  2. Chapter II - Obligations of Data Fiduciary7 provisions
  3. Chapter III - Rights and Duties of Data Principal5 provisions
  4. Chapter IV - Special Provisions2 provisions
  5. Chapter V - Data Protection Board of India9 provisions
  6. Chapter VI - Powers, Functions and Procedure of Board2 provisions
  7. Chapter VII - Appeal and Alternate Dispute Resolution4 provisions
  8. Chapter VIII - Penalties and Adjudication2 provisions
  9. Chapter IX - Miscellaneous10 provisions
  10. The Schedule1 provision

Frequently asked questions

What is the DPDP Act, 2023?

India's law governing the processing of digital personal data, balancing individuals' right to protect their data with the need to process it for lawful purposes. Read the provision

Who does the DPDP Act apply to?

It applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to Data Principals in India (Section 3). Read the provision

When can personal data be processed?

Only for a lawful purpose, either with the Data Principal's consent or for certain legitimate uses listed in Section 7 (Section 4). Read the provision

What rights does a Data Principal have?

Rights to information, correction and erasure, grievance redressal and nomination, under Sections 11 to 14. Read the provision

What are the penalties under the DPDP Act?

The Data Protection Board may impose the penalties set out in the Schedule, which run up to ₹250 crore for failing to take reasonable security safeguards (Section 33). Read the provision

How does the DPDP Act differ from the GDPR?

Both regulate personal data, but the DPDP Act covers digital personal data only, uses two processing grounds instead of six, and has no separate category of sensitive data. Compare the two in the GDPR library. Open the GDPR library

Chapter VI - Powers, Functions and Procedure of Board