DPDP basics
One law, nine chapters, and a two-part test for every record you hold.
The Digital Personal Data Protection Act, 2023 (the Act) is India's first law written only about personal data. It is short: 44 sections in nine chapters, with much of the detail left to the Digital Personal Data Protection Rules, 2025 (the Rules). This page covers what the Act reaches, what it leaves alone, how it is laid out, and the order in which to read the rest of this library.
Back to DPDP services01 · What it reaches
Two questions decide whether the Act touches a record
Is it about an identifiable person, and is it held in digital form?
The Act reads personal data widely: any data about an individual who can be identified by it or in relation to it. A name qualifies. So does a device ID tied to an account, a voice note, or a support ticket that quotes an order number linked to a customer. The second filter is form. The Act governs digital personal data, which covers data collected digitally and data collected on paper and digitised later. A paper application form comes into scope the moment someone scans it.
- Data principal
- The person the data is about. For a child, this includes the parents or lawful guardian; for a person with a disability who has a lawful guardian, that guardian acting for her.
- Data fiduciary
- Whoever decides why and how the data is processed, alone or with others. Almost every duty lands here.
- Data processor
- Anyone who processes personal data on behalf of a fiduciary.
- Processing
- Any wholly or partly automated operation on digital personal data, from collection and storage through sharing to erasure.
- Data Protection Board of India
- The body that inquires into breaches and complaints, gives directions and imposes penalties (the Board).
Records that stay on paper and are never digitised fall outside the Act. In practice a scan, a photo or a typed entry usually brings a paper record into scope.
02 · Inside and outside India
Inside India, and sometimes well beyond it
Where the servers sit matters less than whom you serve.
Processing in India
- Covers digital personal data processed within India, whoever the people are.
- Applies to data collected digitally and to paper data that is later digitised.
- One carve-out: an Indian business processing data of people outside India under a contract with a foreign party is relieved of most duties by section 17(1)(d), though the security duty and its responsibility for processors remain.
Processing outside India
- Covered when it is connected to offering goods or services to people in India.
- A foreign app with Indian users, or an overseas platform selling into India, is inside the Act.
- Processing abroad with no link to an Indian offering falls outside this test.
The Act does not name monitoring or profiling of people in India as a separate trigger. The link to an offering is the test.
Illustrative: a Singapore company sells online courses to students in Pune and stores everything in a European cloud region. No processing happens in India, yet the Act applies, because the processing serves an offer made to people in India.
03 · What it leaves out
What sits outside the Act
Two exclusions in the scope section, and a set of exemptions further on.
| Situation | Position | Example |
|---|---|---|
| Personal or domestic use by an individual | Outside the Act (section 3) | Family photos and contacts on a personal phone |
| Data the person made public herself | Outside the Act (section 3) | Details someone chose to post openly on social media |
| Data published under a legal duty | Outside the Act (section 3) | Information an Indian law obliges a body to make public |
| Paper records never digitised | Outside the Act | A register that only ever exists on paper |
| Legal claims, courts and regulators, crime prevention | Most duties and rights switched off (section 17(1)); the security duty still applies | Processing evidence for a lawsuit |
| Research, archiving or statistics | Act does not apply if no decision is taken about an individual and the prescribed standards are followed (section 17(2)(b), rule 16) | A survey analysed only in aggregate |
| Notified State instrumentalities | Can be exempted on grounds such as security of the State and public order (section 17(2)(a)) | Agencies the Government notifies |
The Act does not mention anonymised data. If no one can be identified from it, it is not personal data, so the real question is whether re-identification is realistic. The limits of each exemption are covered in the guide on processing without consent.
04 · No sensitive tier
One kind of personal data, not two
The Act keeps no separate 'sensitive data' list. It handles risk in other ways.
Many privacy laws keep a stricter list for health, biometrics, finances or beliefs. This Act does not. A blood-test result and an email address are both simply personal data, with the same grounds and the same duties. The older rules on sensitive personal data rested on section 43A of the Information Technology Act, 2000; section 44 of the Act omits section 43A.
- Volume and sensitivityThe Government weighs them when it notifies significant data fiduciaries, who carry extra duties.
- ChildrenA child's data needs verifiable parental consent, and tracking, behavioural monitoring and targeted ads aimed at children are barred.
- SecurityReasonable safeguards are likely to be judged against what a leak could do, so a clinic will be held to a clinic's risk.
- Sector rulesBanking, insurance, health and telecom regulators keep their own rules, which sit beside the Act.
What this means for your data map
Do not stop at tagging data as 'sensitive'. Record whose it is (customers, children, staff), why you hold it, and what harm a leak would cause. Those three answers drive your duties under this Act.
05 · How it is laid out
Nine chapters and a Schedule
Read Chapters II and III first. Most of the rest is machinery.
- Ch. IPreliminaryTitle, definitions and where the Act applies (sections 1 to 3).
- Ch. IIObligations of data fiduciariesGrounds, notice, consent, legitimate uses, general duties, children and significant fiduciaries (sections 4 to 10).
- Ch. IIIRights and duties of data principalsAccess, correction and erasure, grievance, nomination, and the individual's own duties (sections 11 to 15).
- Ch. IVSpecial provisionsTransfers outside India and the exemptions (sections 16 and 17).
- Ch. VThe BoardHow the Data Protection Board of India is set up and staffed (sections 18 to 26).
- Ch. VIPowers and procedure of the BoardInquiries, directions and how the Board runs (sections 27 and 28).
- Ch. VIIAppeals and dispute resolutionAppeals to the Telecom Disputes Settlement and Appellate Tribunal, mediation and voluntary undertakings (sections 29 to 32).
- Ch. VIIIPenaltiesPenalties set by reference to the Schedule (sections 33 and 34).
- Ch. IXMiscellaneousRule-making, the relationship with other laws, and amendments to other Acts (sections 35 to 44).
- SchedulePenalty ceilingsUp to 250 crore rupees for failing to take reasonable security safeguards, with lower ceilings for other breaches.
Much of the Act says 'as may be prescribed'. The Rules fill those gaps: notice content, security measures, breach intimation, retention periods, consent managers, children's consent, the extra duties of significant fiduciaries and the Board's procedure.
06 · What is in force
What is live now, and what is still coming
The Rules switch on in three steps from November 2025.
| Step | What switches on | When |
|---|---|---|
| Step 1 | Definitions and the Board's set-up and procedure (rules 1, 2 and 17 to 21) | On publication, November 2025 |
| Step 2 | Consent manager registration and obligations (rule 4) | One year after publication: November 2026 |
| Step 3 | Notice, security, breach intimation, retention, children, significant fiduciaries, rights, transfers, research, appeals and calls for information (rules 3, 5 to 16, 22 and 23) | Eighteen months after publication: around May 2027 |
As of October 2026, the Board has been established, the consent manager rule is weeks away, and the day-to-day duties most companies care about arrive with step 3. A data map, new notices, a rights workflow and revised processor contracts all have to be in place by then, which is why most programmes are already under way.
07 · Reading order
Where to go next in this library
A sensible reading order for a founder or compliance lead.
| Order | Guide | What you take away |
|---|---|---|
| 1 | Data fiduciary, processor or consent manager? | Your role for each processing activity |
| 2 | What a data fiduciary must do | The duty list, with owners and evidence |
| 3 | Valid consent and notices | How to ask, and what to say when you ask |
| 4 | Processing without consent | The legitimate uses and exemptions, and their limits |
| 5 | Data principal rights, and running requests | The rights and a workflow to answer them |
| 6 | Data mapping and the processing record | The inventory every other task depends on |
| 7 | Personal data breaches under the DPDP Act | Who is told, what, and when |
| 8 | The DPDP Rules, 2025 | The detail behind each duty, and the phase-in |
| 9 | A DPDP implementation roadmap | The work in a workable order |
- Data fiduciary, processor or consent manager?The three roles the Act names, and which one you are.
- What a data fiduciary must doThe duties, from notice to security to erasure.
- Valid consent and noticesWhat a notice says and what makes consent count.
- The DPDP Rules, 2025What the Rules add to the Act, and how they phase in.
Sources: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), sections 2, 3, 10, 17, 44 and the Schedule; the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), rules 1 and 16.
Questions about the Act's reach
Does the Act apply to a company with no office in India?
Yes, if its processing is tied to offering goods or services to people in India.
The test is the link to an Indian offering, not an address. A foreign company selling to people in India is a data fiduciary for that processing and carries the same duties as an Indian one.
Is employee data covered?
Yes. Employment is a legitimate use, but the other duties still apply.
Section 7 lets an employer process staff data for employment purposes without consent. Security, accuracy, erasure and breach intimation still apply. The access and correction rights attach to data given with consent or volunteered for a purpose, so data held only on the employment ground sits outside them.
Is there a DPDP certificate we can obtain?
No. The Act has no certification scheme.
The Board does not certify anyone, and no body issues a DPDP certificate. What you can hold is evidence: a data map, notices, logs and an independent assessment of your programme against the Act and the Rules.
Does business contact data count?
Yes, when it identifies a person.
The work email and phone number of a named buyer are personal data. The Act has no business-to-business carve-out, so sales and partner lists need a ground, a notice where consent is used, and the same safeguards.
What about data we collected years ago?
Send a notice when practicable; you may keep processing until consent is withdrawn.
For consent given before the Act's provisions came into force, section 5(2) asks for a notice as soon as reasonably practicable. Processing can continue until the person withdraws. The consent guide covers what that notice says.
Find out where the Act touches your business.
A DPDP readiness assessment maps your data, your roles and your gaps against the Act and the Rules. Counsel should confirm how the law applies to your contracts.