The Digital Personal Data Protection Act, 2023 is India's data protection law. It applies to digital personal data processed in India, and to processing outside India that relates to offering goods or services to people in India. It puts duties on Data Fiduciaries, gives rights to Data Principals and is enforced by the Data Protection Board of India.
Free account needed to download. You come straight back to the file.
Who it is for. Any organisation, in India or abroad, that decides why and how personal data of people in India is processed. This includes processors working for it, which the fiduciary is answerable for.
What this list covers. DPDP Act, 2023 (Act 22 of 2023); the Rules made under it add detail and are phased in: 21 sections. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| s. 4 | Grounds for processing | Process personal data only with the person's consent or for one of the legitimate uses the Act lists, and only for a lawful purpose. |
| s. 5 | Notice | Before or when asking for consent, tell the person what data you collect and why, how to exercise their rights and how to complain to the Board, and offer the notice in English or an Eighth Schedule language. |
| s. 6 | Consent | Make consent free, specific, informed, unconditional and unambiguous, limited to what is needed, and as easy to withdraw as to give. Present each request in plain language, in English or an Eighth Schedule language. |
| s. 6(7)-(9) | Consent Managers | A person may give, manage, review or withdraw consent through a Consent Manager, which is registered with the Board and is accountable to her. |
| s. 7 | Certain legitimate uses | Where you rely on a legitimate use, such as a voluntary provision for a stated purpose or compliance with law, stay within it. |
| Ref | Control | What it requires |
|---|---|---|
| s. 8(1)-(3) | Responsibility and accuracy | Be responsible for personal data in your control, including data a processor handles for you, and keep data accurate where it is used for a decision or shared. |
| s. 8(5) | Reasonable security safeguards | Protect personal data with reasonable security safeguards to prevent a breach. |
| s. 8(6) | Breach intimation | Tell the Data Protection Board and each affected person when a personal data breach happens. |
| s. 8(7) | Erasure when purpose ends | Erase personal data when consent is withdrawn or the purpose is no longer served, unless the law requires you to keep it, and make processors do the same. |
| s. 8(9) | Publish contact details | Publish the contact details of the person who can answer questions about processing, such as the DPO where one is appointed. |
| s. 8(10) | Grievance redressal | Provide a way for people to raise a grievance with you. |
| s. 9 | Children's data | Obtain verifiable consent of a parent or guardian, and do not track, monitor behaviour or target advertising at children. |
| s. 10 | Significant Data Fiduciaries | If designated, appoint a Data Protection Officer who is based in India, answers to the board and is the grievance contact; appoint an independent data auditor; and run periodic impact assessments and audits. |
| Ref | Control | What it requires |
|---|---|---|
| s. 11 | Right to information | Give the person, on request, a summary of the data you hold, the processing and who it has been shared with. |
| s. 12 | Right to correction and erasure | Correct, complete or update data, and erase it when asked, subject to the exceptions in the Act. |
| s. 13 | Right of grievance redressal | Respond to grievances within the period prescribed, before a person goes to the Board. |
| s. 14 | Right to nominate | Let a person nominate someone to exercise their rights in the event of death or incapacity. |
| s. 15 | Duties of the Data Principal | Individuals must comply with the law, not impersonate, not suppress material information, and not file false complaints. |
| Ref | Control | What it requires |
|---|---|---|
| s. 16 | Transfer outside India | Transfers abroad are allowed except to countries the Government restricts by notification, and stricter sector laws still apply. |
| s. 17 | Exemptions | Know which exemptions apply to you, such as for certain legal, research or State purposes. |
| s. 18 and the Schedule | Data Protection Board and penalties | Expect inquiry by the Board, with monetary penalties set out in the Schedule for failures such as inadequate security safeguards or not reporting a breach. |
The Act was passed in August 2023. Commencement has been phased by notification and the Digital Personal Data Protection Rules add procedure, so check the current dates on the Ministry of Electronics and Information Technology site.
The person or organisation that alone or with others decides the purpose and means of processing. It is the equivalent of a controller under the GDPR.
Only for Significant Data Fiduciaries, which the Government designates by volume and sensitivity of data and other factors. The DPO must be based in India.
It is shorter and consent-centred, covers digital data only, has no separate special category of data and has fewer legal bases. It also uses a Board and a Schedule of penalties.