An introduction to India's Digital Personal Data Protection Act, 2023 — who it applies to, key roles and what it means for your organisation.
Overview
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's comprehensive law governing how organisations process digital personal data. It balances the rights of individuals to protect their personal data with the need for businesses to process that data for lawful purposes.
The Digital Personal Data Protection Rules, 2025 operationalise the Act and provide a phased timeline for businesses to put the required measures in place.
Who does it apply to?
The Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. This covers data collected digitally as well as non-digital data that is later digitised.
Key roles
- Data Principal: the individual to whom the personal data relates. For children and persons with disabilities, this includes parents or lawful guardians.
- Data Fiduciary: the organisation that decides the purpose and means of processing personal data.
- Data Processor: any entity that processes personal data on behalf of a Data Fiduciary.
- Data Protection Board of India: the authority responsible for inquiries into breaches and imposing penalties.
Why it matters
Penalties under the Act can reach up to ₹250 crore for certain failures, such as not taking reasonable security safeguards to prevent a personal data breach. Beyond penalties, strong privacy practices build customer trust and support business growth.
This article provides general information and does not constitute legal advice.