Why this guide
The Digital Personal Data Protection Act, 2023 is short, but every section has practical weight. This guide unpacks each obligation in plain English.
Scope
The Act applies to digital personal data processed in India, and, in defined circumstances, to data fiduciaries outside India.
Consent
Consent must be free, specific, informed, unconditional, and unambiguous. Notice obligations are detailed and stricter than the IT Rules predecessor.
Data Principal Rights
Individuals get access, correction, erasure, and grievance redress rights, operationalise these in your product.
Penalties
Up to INR 250 crore for the most serious breaches; design your incident response with this in mind.