What Is the DPDP Act? Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law, enacted in August 2023 after more than five years of legislative iteration. The Act governs the processing of digital personal data within India and the processing of digital personal data outside India when such processing is in connection with offering goods or services to data principals (the Act's term for data subjects) in India. DPDP Act is built around a rights/obligations framework: data principals have rights concerning information, correction and erasure, grievance redressal, nomination, and withdrawal of consent; data fiduciaries (controllers) have corresponding obligations centered on notice, consent, data minimization, purpose limitation, and breach notification. The Act designates certain 'Significant Data Fiduciaries' based on volume and sensitivity for heightened obligations including Data Protection Officers and audits, subject to the Act, rules, notifications, and commencement dates. The Data Protection Board of India is the statutory adjudicatory authority under the Act, with powers to issue directions and impose financial penalties up to ₹250 crore per contravention where the Schedule and applicable provisions allow. MeitY notified the DPDP Rules and established the Board by notifications dated 13 November 2025, with staged commencement dates. A 2026 Removal of Difficulties Order made textual clarifications to sections 9 and 10 without changing those staged commencement dates; a May 2026 notice concerns later appointment activity. Check the current enforcement timeline before relying on an obligation that has not yet commenced.
At a glance
- Full name
- Digital Personal Data Protection Act, 2023
- Short code
- DPDP Act
- Jurisdiction
- India
- Enacted
- 2023
- Last major update
- Digital Personal Data Protection Rules notified in November 2025 with staged commencement; the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 made textual clarifications to sections 9 and 10 without changing the staged commencement dates; 2026 Board appointment activity
- Regulator
- Data Protection Board of India
- Private right of action
- No
- Statutory citation
- Act No. 22 of 2023
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act (highlighted), PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: DPDP Act statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who DPDP Act covers
Protected data
Data subject rights
Right to obtain information about processing (Section 11), summary of personal data processed and with whom shared
Right to correction, completion, updating, and erasure (Section 12)
Right of grievance redressal (Section 13), readily available means to register grievances
Right to nominate (Section 14), designate an individual to exercise rights on death or incapacity
Right to withdraw consent for consent-based processing (Section 6), subject to the Act and disclosed consequences
Notable features
DPDP Act relies heavily on delegated rulemaking by the Central Government. It introduces a nomination right in Section 14, allowing a data principal to name another individual to exercise rights on death or incapacity. The Act also contains exemptions for the State and certain processing in the interest of national security, public order, or prevention of offences; the exact effect depends on the text and any applicable notification or rule.
Enforcement & penalties
Regulator: Data Protection Board of India
Penalties: Schedule to the Act sets maximum penalties per contravention: up to ₹250 crore for failing to take reasonable security safeguards; ₹200 crore for failing to notify breaches; ₹200 crore for violations relating to children's data; ₹150 crore for violations of Significant Data Fiduciary obligations. The Data Protection Board determines penalties case-by-case based on nature, gravity, duration, and impact.
Private right of action: DPDP Act does not grant a private right of action. Enforcement runs exclusively through the Data Protection Board of India. Data principals can file complaints with the Board, which may impose financial penalties (remitted to the Consolidated Fund of India). Individual damages typically require parallel civil/tort claims under general Indian law.
Relevance to data brokers
DPDP Act can apply to processing outside India when it is connected with offering goods or services to data principals in India. A data broker should assess the Act, rules, commencement dates, exemptions, and any sectoral law before drawing a compliance conclusion. Indian residents can use the grievance and Board routes that are available under the current implementation.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does DPDP Act replace the Information Technology Rules (SPDI Rules 2011)?+
Yes, once Section 44(3) of DPDP Act is fully in force, it repeals Section 43A of the IT Act 2000 (the basis for the 2011 Sensitive Personal Data or Information Rules). Until rules are fully notified and in force, the SPDI Rules continue to apply for sensitive data categories they covered.
How do I file a complaint under DPDP Act?+
Under Section 13, you must first approach the data fiduciary's grievance officer. If the data fiduciary fails to resolve the complaint within a prescribed period, you can escalate to the Data Protection Board of India. The Board's process for accepting complaints has been established via notification under Section 28.
What is a Significant Data Fiduciary?+
A data fiduciary notified by the Central Government as 'Significant' based on factors such as volume and sensitivity of personal data processed, risk of harm to data principals, public-order implications, and security of the state. Significant Data Fiduciaries have additional obligations under Section 10, subject to the Act, Rules, notifications, and commencement dates.
Does DPDP Act apply to foreign data brokers?+
It may. Section 3(b) can extend the Act to processing outside India when it is connected with offering goods or services to data principals in India. Whether a particular foreign broker falls within scope depends on the activity, the current commencement position, exemptions, and other applicable law.
Official sources & citations
- MeitY. Digital Personal Data Protection Act, 2023 (official text)
- MeitY. DPDP Act commencement notification (G.S.R. 843(E))
- MeitY. DPDP Act 2023 current document page
- Data Protection Board of India
- MeitY. Notified DPDP Rules 2025
- MeitY. DPDP Rules 2025 and enforcement timeline index
- MeitY. Data Protection Board of India appointment notice (6 May 2026)
- Data Security Council of India. Brief on the DPDP Removal of Difficulties Order, 2026
Other international privacy regimes
DPDP Act sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: