DPDP Act 2023: Complete Guide to India’s Digital Personal Data Protection Law

1. Historical Background: The Road to India’s Data Privacy Law ↑ Contents

You opened an app this morning. It asked for your name, phone number, date of birth, and location. You clicked “I Agree” and moved on with your day. But do you know where that data went? Who has access to it? Can they share it? Sell it? And what happens if it leaks?

For decades, India had no comprehensive answer to those questions. That changed on 11 August 2023.

The IT Act 2000 and Section 43A

India’s first attempt at digital privacy came through the Information Technology Act, 2000, and its amendment in 2008. Section 43A of the IT Act introduced liability for body corporates that were negligent in maintaining “reasonable security practices” for sensitive personal data. But Section 43A had serious limitations — it was narrow, enforcement was weak, and it was reactive rather than preventive.

The Puttaswamy Judgment: Privacy as a Fundamental Right

Justice Srikrishna Committee (2018)

Following the Puttaswamy judgment, the Government constituted a Committee of Experts on Data Protection chaired by retired Supreme Court Judge Justice B.N. Srikrishna. The committee submitted its report and a draft Personal Data Protection Bill in July 2018, drawing heavily from the EU’s GDPR while accounting for India’s unique context.

The Legislative Journey (2019–2023)

The six-year journey from the Puttaswamy judgment to the final legislation reflects the complexity of balancing individual privacy with India’s growing digital economy.

2. Why the DPDP Act Matters ↑ Contents

Before the DPDP Act, an organisation could legally collect far more data than it needed, store your data indefinitely, share it with third parties without meaningful consent, and suffer a data breach without any obligation to inform you. The DPDP Act changes all of this.

For businesses, the DPDP Act is not just a compliance burden — it is a business opportunity. Organisations that demonstrate strong data governance earn customer trust and competitive advantage. Privacy-compliant businesses attract global investment, win enterprise clients, and access international markets that demand privacy standards.

3. Who Does the DPDP Act Apply To? ↑ Contents

Territorial Applicability

The DPDP Act applies to:

1. Processing of digital personal data within India — whether collected in digital form, or collected in non-digital form and subsequently digitised.
2. Processing of digital personal data outside India — if such processing is in connection with offering goods or services to individuals within India.

Key Roles Defined

What Qualifies as Personal Data?

The DPDP Act defines personal data broadly as: “any data about an individual who is identifiable by or in relation to such data.”

This includes names, phone numbers, email addresses, Aadhaar numbers, PAN, financial information, health records, location data, biometric data, device identifiers, IP addresses, photographs, and behavioural and preference data.

4. Key Definitions You Must Know ↑ Contents

5. Core Principles of the DPDP Act ↑ Contents

The DPDP Act is built on seven foundational principles drawn from global best practices.

6. Consent Under the DPDP Act ↑ Contents

Consent is the cornerstone of the DPDP Act. Before processing personal data, a Data Fiduciary must obtain consent that is free, specific, informed, unconditional, and unambiguous.

Deemed Consent — When Consent Is Not Required

The DPDP Act recognises that consent is not always practical. “Deemed consent” (processing without explicit consent) is permitted in specific situations:

1. Voluntary provision for evident purpose — e.g., giving your address to a courier for delivery
2. State functions — government processing for welfare schemes, legal functions, subsidies
3. Legal proceedings — processing required for legal proceedings or asserting legal rights
4. Medical emergency — to protect life or health of the principal or another person
5. Employment — lawful employment-related processing
6. Public interest — research, archiving, or statistical purposes

Withdrawal of Consent

A Data Principal can withdraw consent at any time. The withdrawal process must be as easy as giving consent. The Data Fiduciary must stop processing within a reasonable time after withdrawal. Withdrawal does not affect the lawfulness of processing done before withdrawal.

Consent Managers

The DPDP Act introduces Consent Managers — registered intermediaries that provide individuals a single platform to grant, track, modify, and withdraw consent across multiple Data Fiduciaries. This is a globally novel concept designed to empower individuals in India’s complex digital ecosystem.

7. Rights of the Data Principal (Individual) ↑ Contents

The DPDP Act gives every Indian citizen four legally enforceable rights over their personal data.

Duties of the Data Principal

8. Obligations of the Data Fiduciary (Organisations) ↑ Contents

• Give a Clear Notice Before Processing

  Provide a plain-language notice explaining what data is collected, the purpose, how to exercise rights, and grievance officer contact details.

• Obtain Valid Consent

  Secure consent that is free, specific, informed, unconditional, and unambiguous. No pre-ticked boxes. No bundled consent.

• Process Data Only for Specified Purpose

  Use data only for the purpose stated in the notice. Do not repurpose data without fresh consent.

• Maintain Data Quality

  Ensure data processed is accurate, complete, and up-to-date, especially where inaccuracy could cause significant harm.

• Delete Data When No Longer Needed

  Erase personal data when the purpose is fulfilled or consent is withdrawn, unless legally required to retain it.

• Implement Security Safeguards

  Deploy encryption, access controls, audit logs, and incident response plans proportionate to the nature of data and risk.

• Report Data Breaches Promptly

  Notify both the Data Protection Board and affected Data Principals in the event of a personal data breach, in the prescribed form and timeframe.

• Establish a Grievance Redressal Mechanism

  Designate a named grievance officer, publish contact details prominently, and resolve complaints within prescribed timelines.

• Conduct Due Diligence on Data Processors

  Ensure third-party processors meet adequate data protection standards through contractual obligations.

• Comply with Data Principal Requests

  Respond to access, correction, and erasure requests accurately and within prescribed timelines.

9. Significant Data Fiduciaries: Special Rules for Big Players ↑ Contents

The Central Government may notify certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) based on the volume and sensitivity of data processed, risk to individuals, and threats to national security or electoral democracy.

Additional Obligations for SDFs

10. Data Protection Board of India ↑ Contents

The Data Protection Board of India is India’s independent data protection enforcement authority created by the DPDP Act. It operates as a digital-first body — complaints can be filed, hearings conducted, and orders issued entirely online.

Powers of the Data Protection Board

• Inquire into complaints from Data Principals
• Summon Data Fiduciaries and examine records
• Impose financial penalties up to prescribed limits
• Issue directions to Data Fiduciaries
• Block or restrict data processing activities in extreme cases
• Refer matters to appropriate authorities

How to File a Complaint

You must first exhaust the Data Fiduciary’s internal grievance mechanism before escalating to the Board. The Board’s process is designed to be fully digital, affordable, and accessible in multiple Indian languages.

11. Penalties Under the DPDP Act ↑ Contents

The Penalty Schedule (Schedule 1 of the Act)

Illustrative Scenarios

12. Exemptions Under the DPDP Act ↑ Contents

13. Cross-Border Data Transfers ↑ Contents

Personal data may be transferred to any country or territory outside India except those that the Central Government specifically restricts. This is a blacklist approach — transfers are permitted by default unless restricted — the opposite of GDPR’s adequacy-first approach.

14. Children’s Data: The Strongest Protections ↑ Contents

Under the DPDP Act, a “child” means an individual below 18 years of age. Children’s personal data receives the most comprehensive protection in the Act.

Requirements Before Processing Children’s Data

1. Obtain verifiable parental consent — not just a checkbox declaring age
2. Ensure processing is not detrimental to the well-being of the child

Categorically Prohibited Activities

India has over 500 million internet users below 18 years of age. A gaming app that tracks a 14-year-old’s gameplay behaviour to serve targeted in-app purchase recommendations — without verifiable parental consent — is now in clear violation of the DPDP Act and faces penalties up to ₹200 crore.

15. DPDP Act vs GDPR: Key Differences ↑ Contents

16. DPDP Act and Existing Indian Laws ↑ Contents

17. DPDP Act Compliance Roadmap for Businesses ↑ Contents

Phase 1: Data Discovery and Mapping (Months 1–2)

1. Conduct a Data Audit — Map every category of personal data: what, from whom, for what purpose, where stored, who has access, how long retained, and with whom shared.
2. Map Data Flows — Document how data moves from collection through storage, use, sharing, and deletion.
3. Classify Data by Risk — Financial, health, and children’s data require higher levels of protection.

Phase 2: Consent and Notice Framework (Months 2–3)

4. Audit Existing Consent Mechanisms — Review all consent forms, privacy policies, and cookie banners for DPDP Act compliance.
5. Redesign Notice and Consent Architecture — Create plain-language, granular consent mechanisms with easy withdrawal options.
6. Update Privacy Policy — Write in plain language, available in multiple Indian languages, easily accessible, regularly updated.

Phase 3: Rights Fulfilment Infrastructure (Months 3–4)

7. Set Up Data Principal Request Management — Build or purchase a system to receive, track, and respond to access, correction, and erasure requests.
8. Designate a Grievance Officer — Appoint a named individual and publish contact details prominently on your website and app.

Phase 4: Security and Breach Response (Months 4–5)

9. Implement Technical Security Measures — Encryption at rest and in transit, multi-factor authentication, role-based access controls, regular penetration testing, audit logs.
10. Develop a Data Breach Response Plan — Include internal escalation procedures, assessment criteria, notification templates for the Data Protection Board and affected individuals, and clear timelines.

Phase 5: Third-Party Management (Month 5)

11. Audit Data Processors — Review all third-party cloud providers, analytics tools, CRMs, and marketing platforms that process personal data on your behalf.
12. Update Data Processing Agreements — Include scope of processing, security obligations, breach notification duties, deletion obligations at contract end, and audit rights.

Phase 6: Training and Culture (Ongoing)

13. Train Your Team — Every employee handling personal data must understand DPDP Act requirements, breach identification, and escalation procedures.
14. Build a Privacy-First Culture — Periodic data audits, privacy impact assessments for new products, regular policy reviews, and board-level accountability.

18. DPDP Act for Startups and Small Businesses ↑ Contents

Many startup founders are asking: “We are a 10-person team. Does this law really apply to us?” The honest answer is: yes, but with nuance.

The DPDP Act explicitly empowers the Central Government to exempt certain classes of startups from specific provisions. However, these exemptions have not yet been notified. Until they are, all Data Fiduciaries — regardless of size — are technically subject to the full Act.

The Business Case for Startup Compliance

• Earn user trust — critical in an era of growing privacy awareness
• Attract investment — global investors increasingly scrutinise data governance
• Enable international expansion — GDPR-adjacent compliance makes entering EU/US markets easier
• Avoid catastrophic penalties — a ₹250 crore penalty can destroy a startup overnight
• Win enterprise clients — B2B clients increasingly demand vendor DPDP compliance

19. DPDP Act for NRIs ↑ Contents

Non-Resident Indians whose personal data is processed by Indian entities — a bank, an investment platform, a healthcare provider, or a family property management service — are Data Principals entitled to all rights under the DPDP Act.

This means NRIs can request access to their personal data held by Indian entities, demand correction of incorrect information, request erasure of data no longer needed, and file complaints with the Data Protection Board if their rights are violated.

For NRIs who own or operate businesses in India, the Indian entity is a Data Fiduciary subject to the full DPDP Act. If your business has global operations that process Indian citizens’ data, extraterritorial provisions may also apply.

For professional guidance on NRI data rights or DPDP compliance for NRI-owned Indian businesses, consult the Midhati team.

20. Myths vs Facts About the DPDP Act ↑ Contents

21. Common Mistakes to Avoid ↑ Contents

22. Expert Tips for DPDP Compliance ↑ Contents