Digital Personal Data Protection Act, 2023 (“DPDP Act”)
Digital Personal Data Protection Rules, 2025 (“DPDP Rules”)
(together, the “DPDP Regulations”)

A. What it is

India’s data protection regime has three main parts:

• The DPDP Act. This is the law Parliament passed. It sets out the principles, rights and duties.
• The DPDP Rules. These were notified in November 2025 and explain how the Act works in practice.
• The Data Protection Board of India. This is the independent body that enforces the DPDP Regulations.

In short, the DPDP Regulations govern how organisations collect and use personal data about individuals, and what individuals can do about it.

B. What it covers

The DPDP Regulations cover personal data. They regulate how businesses, government bodies and other organisations collect, store, use, share and delete the personal data of their customers, employees and others.

Personal data means any information about an individual who can be identified from it, such as a name, phone number, Aadhaar number, account details, location or photo.

The DPDP Regulations apply when personal data is in digital form. That includes paper records that are later scanned or typed into a system, i.e. converted into digital form.

They also apply to:

• Organisations outside India, if they process personal data to offer goods or services to individuals in India.
• Data sent overseas. Personal data collected in India doesn’t lose its protection when it’s sent abroad. The organisation (the Data Fiduciary) stays fully responsible for it, even when an overseas vendor handles it. The government can also block transfers to particular countries, and stricter sector rules (such as RBI’s rule on keeping payment data in India) still apply.

They do not cover:

• Personal data an individual uses for purely personal or household purposes, such as the contacts on their phone.
• Personal data that is publicly available because the individual chose to make it public, or because someone was legally required to publish it (for example, a company director’s details on the MCA portal).

C. The key players

D. The basic idea: consent, or a legitimate use

An organisation can process an individual’s personal data for only two kinds of reason:

1. The individual has given consent. The consent must be free, specific, informed, unconditional and unambiguous, and given by a clear action. A pre-ticked box doesn’t count, and an organisation can’t make an individual agree to unrelated uses of their data as a condition of a service. Before asking for consent, the organisation must give a separate, plain-language consent notice that sets out what data it wants, why it wants it, how consent can be withdrawn, and how to complain to the Data Protection Board.

Individuals can withdraw consent at any time, and withdrawing must be as easy as giving it. Withdrawal doesn’t make the earlier use of the data unlawful. It may, however, affect the individual’s ongoing use of the services or products concerned.

2. The law recognises a “legitimate use”. These are specific situations where consent isn’t needed. Examples are when an individual voluntarily gives data for a particular purpose (such as an address for a delivery), government benefits and services, legal obligations, medical emergencies, disasters, and certain employment purposes.

E. What organisations must do

• Purpose and minimum data. Use personal data only for the stated purpose, and collect only what that purpose needs.
• Accuracy. Keep the data accurate and complete, especially when it’s used to make decisions about the individual.
• Security. Protect the data with reasonable safeguards, such as encryption, access controls, logs and backups. Organisations are also responsible for the security of personal data they pass to their vendors.
• Breach reporting. If data is leaked or hacked, inform the Data Protection Board and every affected individual promptly. The message to individuals must be in plain language and explain what happened, the likely impact, and what they can do.
• Deletion. Delete personal data when it’s no longer needed or when consent is withdrawn, unless the law requires it to be kept. For large e-commerce, gaming and social media platforms, the DPDP Rules set fixed periods of inactivity after which data must be deleted, with advance notice to the user.
• Contact point and grievances. Publish a contact person for queries and run an effective grievance redressal mechanism.
• Children and persons with disabilities. Obtain verifiable consent from a parent before processing a child’s (under 18) personal data. Organisations must not track or monitor children’s behaviour, or target advertising at them. The same verifiable consent requirement applies to the lawful guardian of a person with a disability.

Significant Data Fiduciaries have more to do. They must appoint a Data Protection Officer based in India, carry out a Data Protection Impact Assessment every year, and have an independent data audit every year.

F. Rights of individuals (Data Principals)

These rights apply to personal data an individual has given an organisation with consent, or voluntarily for a specific purpose. Individuals can:

• Know what personal data the organisation holds about them, what it is doing with it, and which other organisations it has been shared with.
• Correct, complete or update data that is wrong, incomplete or outdated.
• Erase data that is no longer needed, unless the organisation must keep it by law (for example, KYC records).
• Complain to the organisation first and then, if they aren’t satisfied, to the Data Protection Board.
• Nominate someone to exercise their rights if they die or can’t act themselves.

Each organisation must publish how long it takes to respond to grievances, and that time can’t exceed 90 days.

Individuals have duties too. They must not give false information, impersonate someone else, hide relevant facts when providing their details, or file false or frivolous complaints. Breaking these duties can lead to a fine of up to ₹10,000.

G. Enforcement and penalties

The Data Protection Board of India (DPBI) works entirely online. Complaints are filed and tracked digitally. Appeals against DPBI orders go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

The DPBI imposes financial penalties on organisations. It doesn’t award compensation to individuals.

H. When the DPDP regime comes into effect

The government is bringing the regime into force in phases over an 18-month period that started on 13 November 2025. Most obligations will apply from 13 May 2027. Some provisions are already in effect:

• From 13 November 2025: The Data Protection Board of India was set up, along with its powers and procedures.
• From 13 November 2026: The framework for registering Consent Managers came into force.
• From 13 May 2027: All remaining obligations apply. These include consent notices, security safeguards, breach reporting, individuals’ rights, children’s data, Significant Data Fiduciary duties and penalties.

Organisations now have about six months left to get ready.

I. The one-line summary

For organisations: collect only what you need and say why; get valid consent or have a legitimate use; keep the data safe and report breaches; respect individuals’ rights; and delete data once you’re done with it.