India's Digital Personal Data Protection Act, 2023 sets out who can process personal data, on what grounds, and what happens when they get it wrong — here's the structure underneath the headlines.
March 2026 · 5 min read
The Digital Personal Data Protection Act, 2023 is India's law for how digital personal data gets collected, used, stored and protected. It does two things at once: it gives individuals a defined set of rights over their own data, and it gives organisations a defined set of conditions under which they're allowed to process it. Neither half works without the other.
If your organisation handles digital personal data in India — or handles it anywhere while offering goods or services to people in India — the Act applies to you. That reach is deliberately broad, and it's worth taking seriously before assuming it doesn't cover your situation.
The DPDPA isn't just a statement of principle. It sets conditions for when data may be processed at all, assigns specific roles and duties to the entities involved, gives individuals enforceable rights, and backs all of it with a regulator that can investigate and fine. That combination — rules, roles, rights, and teeth — is what makes this a compliance obligation rather than a best-practice suggestion.
A handful of terms carry the entire structure of the Act, so it's worth being precise about them before anything else.
Data Principal is the individual the data is about. Where that individual is a child, the term extends to their parent or lawful guardian; where the individual is a person with a disability, it extends to their lawful guardian acting on their behalf.
Data Fiduciary is whoever — alone or together with others — decides why and how personal data gets processed. This is the party the Act holds primarily accountable.
Data Processor is anyone processing personal data on a Data Fiduciary's behalf, under its instructions.
Digital personal data is personal data in digital form, where "personal data" means any data about an individual who can be identified from it, directly or in combination with other information.
The DPDPA applies to processing of digital personal data collected within India, and to personal data that was first collected offline and later digitised. Notably, it also reaches processing that happens entirely outside India, if that processing is connected to offering goods or services to people inside India — so an overseas entity with Indian customers doesn't get to treat the Act as someone else's problem.
Two carve-outs sit outside the law's reach: personal data an individual processes for purely personal or domestic reasons, and personal data that's already been made publicly available by the Data Principal themselves, or by someone legally required to publish it.
A Data Fiduciary has exactly two legitimate routes into processing personal data: consent from the Data Principal, for a lawful purpose, or one of the specific legitimate uses the Act itself enumerates. "Lawful purpose" is defined broadly — anything not expressly forbidden by law — but that breadth cuts the other way too: if you can't point to consent or a listed legitimate use, you don't have a basis to process.
Where consent is the legal basis, the Act doesn't leave "consent" open to interpretation. It has to be free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action — no pre-ticked boxes, no bundled agreement to unrelated purposes, no assuming silence means yes.
Consent has to track to a specific stated purpose, and collection has to stay limited to what that purpose actually needs. A Data Principal can withdraw consent at any time, and withdrawing has to be roughly as easy as giving it was in the first place — not a design decision buried three menus deep. Once consent is withdrawn, the Data Fiduciary has to stop processing within a reasonable window, unless some other legal basis keeps the processing authorised.
One detail that trips organisations up: the burden of proof runs the other way. It's the Data Fiduciary's job to demonstrate that valid consent existed — not the Data Principal's job to prove it didn't.
The Act lays out a specific set of statutory duties, and they don't stop at "get consent and move on."
A Data Fiduciary remains responsible for compliance even for processing a Data Processor carries out on its behalf. Outsourcing the work doesn't outsource the accountability.
Where personal data feeds a decision affecting the Data Principal, or gets shared with another Data Fiduciary, it has to be complete, accurate, and consistent.
Preventing a personal data breach is a standing obligation, not a one-time setup task.
When a breach happens, both the Data Protection Board and every affected Data Principal have to be notified, in the form and manner the Act prescribes.
Personal data has to be erased once consent is withdrawn, or once it's reasonable to conclude the original purpose no longer applies — unless retention is separately required by law.
Every Data Fiduciary has to publish contact information for its Data Protection Officer (where one is required) or an authorised representative, and stand up a grievance redressal process that actually functions.
The Act gives individuals a defined bundle of rights: to get a summary of what personal data is being processed about them, to correct, complete, update, or erase it, to raise and have a grievance addressed, to withdraw consent where consent was the basis for processing, and to nominate someone else to exercise these rights if they die or become incapacitated. Each of these has to be exercisable in the manner the Act prescribes — not left to whatever process is most convenient for the organisation.
Before processing a child's personal data, a Data Fiduciary needs verifiable consent from a parent or lawful guardian. The Act then draws three hard lines: no processing likely to cause detrimental effect to a child's well-being, no tracking or behavioural monitoring of children, and no targeted advertising directed at them.
The Act creates the Data Protection Board of India, with the power to investigate personal data breaches and non-compliance, issue binding directions, and impose monetary penalties. Anyone unhappy with a Board decision can appeal to the Appellate Tribunal.
Where the Board finds a significant breach of the Act or its Rules, it can impose financial penalties — and those can run as high as ₹250 crore, scaled to the nature and gravity of what went wrong.
Strip away the commentary and the DPDPA comes down to a defined set of grounds for processing personal data, a statutory bar for what counts as consent, a specific list of legitimate uses, security and accountability obligations that sit with the Data Fiduciary, a bundle of rights that belong to the Data Principal, and an enforcement structure with real penalties behind it. That's the governing law for digital personal data processing in India — not a framework borrowed from elsewhere, but a defined statutory structure built for this jurisdiction.
Once the structure makes sense, the natural next question is where your own organisation actually stands against it — our DPDP gap assessment answers that directly.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation