Quick Summary: The Digital Personal Data Protection (DPDP) Act, 2023 is India’s data privacy law that governs how organizations collect, process, store, and protect personal data. It strengthens individual privacy rights while establishing clear responsibilities for businesses handling personal information.
Organizations today collect and process increasing volumes of personal data, making it essential to understand the Digital Personal Data Protection (DPDP) Act, 2023. Business leaders, technology teams, HR professionals, marketers, and anyone responsible for handling personal information should understand its requirements.
The law introduces a structured framework for data privacy and accountability, making compliance a key priority for organizations operating in India.
This guide explains the DPDP Act, its purpose, scope, key business responsibilities, and how it compares with GDPR to help you better understand India’s evolving data privacy landscape. For the principles behind the law, see our guide to the 8 core principles of the DPDP Act 2023.
DPDP full form is Digital Personal Data Protection. The DPDP Act stands for the Digital Personal Data Protection Act, 2023, also called DPDPA.
The DPDP Act in India is the country’s official law for protecting personal data that exists in digital form. In simple terms, it tells organizations what they can do with your data, what they cannot do, and what rights you have as a user.
You can read the official DPDP Act 2023 PDF on the MeitY website.
As the use of digital platforms in India grew rapidly, concerns about digital privacy grew with it. With more people using online platforms, the risks to personal information became higher, and India needed a dedicated law to protect it. The DPDP Act 2023 was introduced to keep both users and businesses safe.
The law came into existence after years of discussion around data privacy in India. The government first introduced the DPDP Bill 2023, which went through reviews and consultations. After approval, it turned data protection into legal responsibility, not just a best practice. The Act received Presidential assent on 11 August 2023.
This move also helped India align with global privacy laws like GDPR, while keeping India’s digital growth in mind.
The DPDP Act covers any digital personal data that can identify an individual, such as name, phone number, email ID, location, and financial or health information.
It applies whether the data was collected online or collected offline and later digitized.
It does not apply to:
The Act uses some simple but important role definitions:
These roles help fix responsibility, so no one can say, “It wasn’t our fault.”
The DPDP law makes one thing very clear: companies cannot collect or use personal data without your permission. Silent data collection is no longer allowed.
Consent is not just a checkbox; it must be honest, clear, and fair.
What Proper Consent Looks Like
For consent to be valid under the DPDP law, it must be:
The law also blocks dark patterns. This means no hidden checkboxes, no misleading buttons, and no tricks that push users to say “yes” without understanding.
Yes. The DPDP Rules, 2025 were notified on 13 November 2025, bringing the Act into force in phases. Provisions on the Data Protection Board of India apply immediately, Consent Manager registration begins in November 2026, and most compliance obligations for businesses apply from 13 May 2027.
The DPDP Act applies to any business, organization, or government body that handles digital personal data in India, including startups, enterprises, and government departments.
It also covers companies based outside India if they offer goods or services to people in India and collect their data. In simple terms, if an entity deals with the data of individuals in India in digital form, the Act applies to it.
The DPDP Act, along with its rules, gives individuals real control over their personal data. Decision-making is no longer limited to companies, as the law promotes transparency and accountability in how data is handled.
As digital data becomes central to business operations, the DPDP Act sets important guidelines for responsible data management. Organizations must ensure personal data is collected, used, and protected with care.
For a practical, step-by-step plan, see our guide on how to get DPDPA compliance in 2026.
Both the GDPR and the DPDP Act protect personal data, but they differ in scope and complexity. GDPR is more stringent, while the DPDP Act takes a simpler, consent-based approach.
|
Aspect |
GDPR (EU) |
DPDP Act (India) |
|
Scope |
Applies to organizations processing EU residents’ data, regardless of location |
Applies to organizations processing digital personal data related to individuals in India |
|
Territorial Reach |
Global applicability if EU data subjects are involved |
Similar extraterritorial reach when offering goods or services to individuals in India |
|
Consent Requirements |
Detailed, explicit, and highly regulated |
Clear, informed, and simpler consent requirements |
|
Lawful Basis for Processing |
Multiple lawful bases (consent, contract, legal obligation, legitimate interests, etc.) |
Primarily consent-driven, with certain legitimate uses permitted |
|
User Rights |
Broad rights including access, rectification, erasure, restriction, portability, and objection |
Rights to access information, correction, erasure, grievance redressal, and nomination |
|
Children’s Data |
Special protections for minors; age thresholds vary by country |
Strict rules for children’s data and parental consent requirements |
|
Privacy Notices |
Detailed and comprehensive disclosure obligations |
Simpler notice requirements focused on transparency |
|
Data Breach Notification |
Generally within 72 hours of becoming aware of a breach |
Notification required as prescribed by authorities |
|
Data Protection Officer (DPO) |
Mandatory in many cases, especially for large-scale processing |
May be required for Significant Data Fiduciaries |
|
Data Protection Impact Assessments |
Often mandatory for high-risk processing activities |
Required for certain Significant Data Fiduciaries |
|
Cross-Border Data Transfers |
Permitted under specific adequacy and safeguard mechanisms |
Allowed except to countries restricted by the government |
|
Compliance Burden |
Extensive documentation and governance requirements |
Relatively streamlined and business-friendly |
|
Penalties |
Up to €20 million or 4% of global annual turnover |
Up to ₹250 crore per instance, depending on the violation |
|
Regulatory Authority |
Data Protection Authorities across EU member states |
Data Protection Board of India |
The DPDP Act is more than a legal requirement, as it reflects a change in how India views digital trust. It reinforces a simple idea: personal data deserves respect, clarity, and care.
For individuals, this law brings greater control and confidence in how their data is used. For businesses, it sets clear expectations and encourages responsible data practices without limiting innovation. As digital interactions grow in scale and complexity, understanding the DPDP Act becomes essential for making informed, ethical decisions.
A broader understanding of Data Security, Data Privacy, and Data Protection also plays a key role in ensuring effective compliance and responsible data management.
Ultimately, the Act marks the beginning of a more accountable, people-first digital ecosystem, one where trust is built through transparency and responsibility.
Q1. What is the DPDP Act in India?
It is India’s main law governing how digital personal data is collected, used, stored, and protected.
Q2. What is the full form of DPDP?
DPDP stands for Digital Personal Data Protection. The full name of the law is the Digital Personal Data Protection Act, 2023 (DPDPA).
Q3. Is the DPDP Act in force?
Yes. It is being implemented in phases after the DPDP Rules, 2025 were notified on 13 November 2025, with full compliance required by 13 May 2027.
Q4. Who does the DPDP Act apply to?
It applies to any individual, business, or organization that collects or processes digital personal data of people in India.
Q5. What is personal data under DPDP?
Personal data refers to any information that can identify an individual, like name, phone number, email, or online activity.
Q6. Why is the DPDP Act important?
It helps protect people’s data, gives users more control, and ensures businesses handle information responsibly.
Q7. What are the 7 principles of data protection?
The seven principles of data protection are lawful use, clear purpose, collection of only necessary data, data accuracy, limited storage, strong security safeguards, and accountability of the organization. Together, these principles ensure personal data is collected responsibly, used transparently, protected effectively, and managed by organizations that are fully responsible for compliance.
Q8. If my business is already compliant with GDPR, do I still need to follow the DPDP Act?
Yes. While GDPR and the DPDP Act are similar in intent, the DPDP Act is specific to India and has its own requirements, so businesses handling data of people in India must comply with it separately.