Think about the last week. You gave your mobile number to a shop for a “loyalty discount”. You clicked “I agree” on an app without reading a word. A hotel photocopied your Aadhaar card and put it in a drawer.
Where does all that information go? Who can see it? Can they sell it? And what can you do if it leaks?
For years, India had no clear answer. Now it does. The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first full law on personal data. The rules that make it work were notified on 13 November 2025, and most of the duties on businesses start on 13 May 2027.
Whether you are an ordinary user, a shop owner, a start-up founder or a foreign company with customers in India, this law affects you. Here is what it means, in plain words.
What is the DPDP Act, in one paragraph?
The DPDP Act sets the rules for how anyone who collects your digital personal data must handle it. It gives you, the individual, clear rights over your data. It puts duties on the businesses and organisations that use it. And it creates a Data Protection Board of India that can investigate complaints and impose penalties of up to ₹250 crore for a single breach.
Who does it apply to?
The Act covers personal data that is:
- collected online, or
- collected offline and later digitised (for example, a paper form typed into a computer).
It also applies to companies outside India if they process data to offer goods or services to people in India. A US software company with Indian users, or a UK online store shipping to India, is covered.
It does not apply to:
- data you use for purely personal or household purposes, and
- data that you yourself made public (for example, a post you chose to make public on social media).
Five words you need to know
The Act uses a few new terms. Once you know them, the rest is easy.
| Term | What it means in simple words | Example |
|---|---|---|
| Data Principal | The person the data is about. That is you. | A customer of a bank |
| Data Fiduciary | The business or body that decides why and how your data is used | The bank |
| Data Processor | A company that handles data on behalf of the fiduciary | The bank’s IT or call-centre vendor |
| Significant Data Fiduciary | A fiduciary the Government marks as high-risk because of the volume or sensitivity of data it handles | Large platforms, big financial players |
| Consent Manager | A registered platform that helps you give, manage and withdraw consent in one place | Works like a “consent dashboard” |
When can a business use your data?
Only on one of two grounds.
1. Your consent. And not just any “I agree”. Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. A pre-ticked box will not do. You must also be able to withdraw consent as easily as you gave it.
Before asking, the business must give you a notice (Section 5) in clear language that tells you what data it is collecting, why, and how you can use your rights or complain. You can ask for this notice in English or any language in the Eighth Schedule of the Constitution.
2. Certain “legitimate uses”. Section 7 lists situations where consent is not needed. For example, when you voluntarily share data for a specific purpose (like giving your number to receive a receipt), for medical emergencies, for employment purposes, or where the State provides a benefit or service.
There is no broad “legitimate interests” ground like Europe’s GDPR. This makes Indian law stricter on consent in many everyday cases.
Your rights as a Data Principal
This is the part most people will want to save.
| Your right | What you can ask for | Section |
|---|---|---|
| Right to information | A summary of what data is held about you, how it is used and who it was shared with | 11 |
| Right to correction and erasure | Fix wrong data, complete missing data, or delete data that is no longer needed | 12 |
| Right to grievance redressal | A quick, working complaint system from the business itself | 13 |
| Right to nominate | Choose someone to exercise your rights if you die or cannot act | 14 |
| Right to withdraw consent | Take back consent at any time, as easily as you gave it | 6(4) |
Under the DPDP Rules 2025, a business must respond to your request within 90 days. If you are not satisfied with the business’s answer, you can then complain to the Data Protection Board.
Worth knowing: you also have duties (Section 15). You must not file false or frivolous complaints, give false details, or impersonate someone else. Breaking these duties can lead to a penalty of up to ₹10,000.
What businesses must do
If your business collects personal data, these are your core duties.
- Give a clear notice and take valid consent before collecting data.
- Use data only for the stated purpose, and keep it only as long as needed.
- Keep the data accurate when it is used to make decisions about the person.
- Put reasonable security safeguards in place. The Rules list them: encryption or masking, access controls, logs and monitoring, backups, and contracts with your vendors that require the same.
- Report every data breach. Inform each affected person without delay, and inform the Data Protection Board, with a detailed report within 72 hours. Unlike GDPR, there is no “low risk” exception.
- Delete data once the purpose is over or consent is withdrawn. Large e-commerce, online gaming and social media platforms must erase data after three years of user inactivity, with at least 48 hours’ notice to the user.
- Keep logs for at least one year, so that breaches can be investigated.
- Publish contact details of a person who can answer data questions, and run a working grievance system.
- Be responsible for your vendors. If your data processor makes a mistake, the duty still sits with you.
Extra rules for children’s data
Anyone under 18 is a child under the DPDP Act. Before processing a child’s data, a business must get verifiable consent from a parent or guardian. It cannot track or monitor children’s behaviour or show them targeted advertising (Section 9). This is much stricter than Europe, where the age is 13 to 16.
Extra rules for Significant Data Fiduciaries
These businesses must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and audit every 12 months.
Sending data outside India
Transfers abroad are allowed, except to countries the Government specifically restricts by notification (Section 16). Sector rules, such as RBI’s data storage rules for payment data, continue to apply on top.
Penalties: how serious is this?
The Schedule to the Act sets the maximum penalty for each type of breach.
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a breach | ₹250 crore |
| Not informing the Board and affected persons of a breach | ₹200 crore |
| Breaking the extra rules on children’s data | ₹200 crore |
| Breaking the extra rules for Significant Data Fiduciaries | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
| A Data Principal breaking their own duties | ₹10,000 |
The Board decides the actual amount after looking at how serious the breach was, how long it lasted, and what the business did to limit the harm.
The timeline: what starts when
| Date | What happens |
|---|---|
| 11 August 2023 | DPDP Act receives Presidential assent |
| 13 November 2025 | DPDP Rules 2025 notified. Provisions setting up the Data Protection Board take effect |
| 13 November 2026 | Consent Manager registration and duties begin |
| 13 May 2027 | Almost all duties on businesses begin: notice, consent, security, breach reporting, rights, children’s data, cross-border transfers |
The Government may shorten this 18-month window. In January 2026, MeitY floated a proposal to cut it to 12 months. As of the date of this article, no amending notification has been issued. Plan for May 2027, but prepare as if it could come earlier. Our DPDP Rules timeline update tracks the latest position.
DPDP vs GDPR: a quick comparison
Many businesses already follow Europe’s GDPR. Here is where India is different.
| Point | GDPR (EU/UK) | DPDP Act (India) |
|---|---|---|
| Legal grounds for processing | Six, including “legitimate interests” | Consent, or specific “legitimate uses” only |
| Breach reporting | Only if risky; to authority within 72 hours | Every breach; to the Board and every affected person |
| Child’s age | 13 to 16 | Under 18 |
| Data covered | Digital and organised paper records | Digital, or paper later digitised |
| Data made public by the person | Still protected | Not covered |
| Transfers abroad | Allowed only to approved countries or with safeguards | Allowed, except to restricted countries |
| Maximum fine | 4% of global turnover or €20 million | ₹250 crore per instance |
Three privacy policy mistakes that break the law
Many Indian websites copied their privacy policy from somewhere else years ago. Under the DPDP Act, three common lines now cause real problems.
| Common line | Why it fails | What to write instead |
|---|---|---|
| “By using our website, you agree to this policy.” | Consent buried in terms of use is not a clear action, and it bundles everything together | Ask separately for each purpose, with an unticked box the user must tick |
| “We use your data to improve our services and for other business purposes.” | Too vague. A person cannot give informed consent to “other purposes” | List each purpose plainly, for example “to send your appointment reminders” |
| A pre-ticked box saying “I agree to share my data with partners” | No real choice was made, so consent is not freely given | Leave the box unticked and name the partners or the type of partner |
A good DPDP-ready privacy policy should cover, at the least: who you are and how to contact your grievance officer; what data you collect; why; the legal ground for each use; how consent is taken and withdrawn; the user’s rights; how long data is kept; who it is shared with; whether it goes abroad; your security measures; how complaints are handled; and the date it was last updated.
A simple 6-step checklist for businesses
Save this list and work through it before May 2027.
- Map your data. List what personal data you collect, where it comes from, where it is stored and who it goes to.
- Rewrite your notices and consent forms in clear language, with an easy way to withdraw.
- Review vendor contracts so every processor follows your security and deletion rules.
- Write a breach plan that names who does what in the first 72 hours.
- Set up a grievance and rights-request process that can reply within 90 days.
- Check for children’s data and add parental consent where needed.
Frequently asked questions
What is the DPDP Act in simple words?
It is India’s law on digital personal data. It tells businesses how they may collect, use, store and delete your data, and gives you rights to see, correct and delete it.
When does the DPDP Act come into force?
The Data Protection Board provisions took effect on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties on businesses start on 13 May 2027.
Does the DPDP Act apply to small businesses?
Yes. There is no general exemption for small businesses. The Government may exempt some classes, such as certain start-ups, from parts of the Act by notification.
Does it apply to companies outside India?
Yes, if they process personal data of people in India to offer them goods or services.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards that lead to a data breach.
Can I complain if my data is misused?
Yes. First use the business’s own grievance system. If it does not resolve your complaint, you can go to the Data Protection Board of India.
Have a question about how the DPDP Act applies to you or your business? You can reach us through our contact page.
This article is for general information only and is not legal advice. The law and the Rules may change. Please check the current position or consult an advocate before acting.