Digital Personal Data Protection Act, 2023.
Advisory on the Digital Personal Data Protection Act, 2023 (DPDPA) — Act No. 22 of 2023 — and the Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY). We help Data Fiduciaries turn the statute into notices, consent, security safeguards and board-ready evidence.
What the DPDPA actually says.
The Digital Personal Data Protection Act, 2023 received the President’s assent on 11 August 2023. Section 1(1) names it the Digital Personal Data Protection Act, 2023. It provides for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process that data for lawful purposes.
The Act applies to digital personal data processed in India — whether collected in digital form or collected in non-digital form and digitised later — and to processing outside India if it is connected with offering goods or services to Data Principals in India. It does not apply to personal data processed by an individual for a personal or domestic purpose, or to personal data made or caused to be made publicly available by the Data Principal or by a person under a legal obligation to make it public. A Data Fiduciary may process personal data only for a lawful purpose, and only with the Data Principal’s consent or for certain legitimate uses set out in the Act.
How MeitY operationalised the Act.
On 13 November 2025, MeitY notified the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), made under section 40 of the Digital Personal Data Protection Act, 2023. The Rules prescribe how notices, Consent Managers, security safeguards, breach intimations, retention, children’s data and Significant Data Fiduciary measures are to work.
Commencement is staggered, as written in Rule 1: Rules 1, 2 and 17 to 21 came into force on the date of Gazette publication (13 November 2025). Rule 4 (registration and obligations of Consent Managers) comes into force one year after that publication (13 November 2026). Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication (13 May 2027). That last tranche includes notices, State processing standards, reasonable security safeguards, breach intimation, erasure timelines, contact information, verifiable consent for children and persons with disability, and Significant Data Fiduciary measures.
DPDPA readiness a board can evidence.
Work is mapped to the Act’s defined roles — Data Principal, Data Fiduciary, Data Processor, Consent Manager and, where notified, Significant Data Fiduciary — and to the Rules that apply to those roles.
- Standalone notices in clear and plain language, with an itemised description of personal data, the specified purpose, and how the Data Principal may withdraw consent, exercise rights and complain to the Data Protection Board of India (Rule 3; sections 5 and 6 of the Act)
- Consent architecture that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose (section 6)
- Reasonable security safeguards to prevent personal data breach — including encryption, obfuscation, masking or virtual tokens, access control, logs, backups, processor-contract clauses and one-year retention of security logs (section 8 of the Act; Rule 6)
- Personal-data-breach playbooks: intimation to affected Data Principals without delay, first intimation to the Board without delay, and a detailed report to the Board within seventy-two hours of becoming aware of the breach, or a longer period the Board allows (section 8; Rule 7)
- Retention and erasure when the specified purpose is no longer served (section 8), including the forty-eight-hour pre-erasure notice for the classes and purposes listed in the Third Schedule (Rule 8), and Data Principal rights of access, correction, completion, updating and erasure (sections 11 and 12)
- Grievance redressal that Data Principals must exhaust before approaching the Data Protection Board of India, and the right to nominate another individual to exercise rights in the event of death or incapacity (sections 13 and 14; Rule 14)
- Verifiable parental consent before processing a child’s personal data, and the Act’s restrictions on tracking, behavioural monitoring and targeted advertising directed at children (section 9; Rule 10)
- Significant Data Fiduciary readiness where the Central Government notifies that class — Data Protection Officer based in India and responsible to the board of directors, independent data auditor, periodic Data Protection Impact Assessment and periodic audit (section 10)
- Published business contact of the Data Protection Officer or other person who can answer questions about processing (Rule 9), and documentation suitable for board review
Sourced from the Digital Personal Data Protection Act, 2023 (No. 22 of 2023) and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025). Confirm the latest Gazette, any corrigendum and Data Protection Board of India directions before acting. See also MeitY. This page is general information. It is not legal advice.