Glossary · Frameworks & standards
What is DPDP Act?
Also known as: Digital Personal Data Protection Act, DPDP Act 2023, India DPDP, Digital Personal Data Protection Act 2023
The Digital Personal Data Protection (DPDP) Act, 2023 is India's national data-protection law. It governs the processing of digital personal data of individuals (data principals) in India on a consent-first basis, grants individuals rights over their data, obliges organizations (data fiduciaries) to protect it, and is enforced by the Data Protection Board of India with penalties up to ₹250 crore per instance.
Key takeaways
- India's first comprehensive personal-data-protection law, enacted in 2023 with rules phasing in through 2025-2026.
- Consent-first: processing generally requires clear, informed consent, with a narrow set of 'legitimate uses'.
- Individuals (data principals) gain rights to access, correction, erasure, grievance redressal, and nomination.
- Organizations (data fiduciaries) must implement safeguards, notify breaches, and appoint grievance officers.
- Penalties reach ₹250 crore per instance, assessed by the Data Protection Board of India.
Who does the DPDP Act apply to?
The Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. Entities that determine the purpose and means of processing are called data fiduciaries; the individuals whose data is processed are data principals.
Certain obligations scale with risk: entities designated as Significant Data Fiduciaries face additional duties such as appointing a Data Protection Officer and conducting periodic data-protection impact assessments.
How does DPDP compare to GDPR?
The DPDP Act shares a common backbone with the EU's GDPR: lawful processing, notice and consent, data-principal rights, breach notification, and accountability. It is, however, more streamlined and consent-centric, and does not (as drafted) carve out a separate sensitive-category regime.
Organizations that already run a strong GDPR program cover much of DPDP, but must add India-specific mechanics such as consent managers, grievance officers, and data-principal nomination.
Frequently asked questions
- When does the DPDP Act come into force?
- The Act was enacted in 2023 and its implementing rules are being phased in through 2025-2026. Organizations processing the personal data of individuals in India should be building toward compliance now.
- What are the penalties under the DPDP Act?
- The Data Protection Board of India can impose penalties up to ₹250 crore per instance, for example for failing to implement reasonable security safeguards or to notify a breach.
- Does GDPR compliance make me DPDP compliant?
- Largely, but not automatically. GDPR is stricter in many areas, so a strong GDPR program covers much of DPDP - but you must add India-specific requirements such as consent managers, grievance officers, and data-principal nomination.