Digital Personal Data Protection Act, 2023 and its 2025 Rules

To provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such data for lawful purposes.[1][7]

long title of the Act, repeated by the government in Parliament (July 2026)

• Scope: digital personal data processed in India, and processing abroad linked to offering goods or services to people in India. Data processed for personal or domestic purposes, or made public by the person concerned or under a legal duty, is excluded.[1]
• Two legal bases: consent — « free, specific, informed, unconditional and unambiguous », withdrawable as easily as it was given, preceded by a notice available in English or any language of the Constitution’s Eighth Schedule — or « certain legitimate uses » (section 7), such as State subsidies, benefits and licences, State functions under law, medical emergencies, disasters and employment.[1]
• Duties of « data fiduciaries » (those who decide why and how data is processed): reasonable security safeguards (encryption, access control, logs kept one year), notice of every breach to the Board and to each affected person — with a detailed report to the Board within 72 hours — erasure once the purpose is served, and a grievance system answering within 90 days. E-commerce, online gaming and social media platforms with at least 2 crore (20 million) registered users in India must erase data after three years of inactivity.[1][2]
• Children (under 18): verifiable consent of a parent, checked against reliable identity and age details or a token such as one from a Digital Locker; no tracking, behavioural monitoring or targeted advertising directed at children, save for classes and purposes exempted by the Rules.[1][2]
• « Significant data fiduciaries », designated by the government according to volume and sensitivity of data, risk to rights, security and electoral democracy: a data protection officer based in India, an independent data auditor, an impact assessment and audit every twelve months, and — for data specified on a committee’s advice — no transfer outside India.[1][2]
• Rights of « data principals »: a summary of their data and of who it was shared with, correction, completion, updating and erasure, grievance redress, and nomination of someone to act on their behalf after death or incapacity. They also have duties — no impersonation, no false or frivolous complaint — punishable by up to ₹10,000.[1]
• Exemptions for the State (section 17): the Act does not apply to instrumentalities the government notifies in the interests of sovereignty, security, friendly relations with foreign States or public order; most duties and rights do not apply to processing for preventing, detecting, investigating or prosecuting offences; State bodies need not erase data; and the government may, within five years of commencement, exempt any data fiduciary from any provision for a set period. Startups may be spared some duties.[1]
• Data Protection Board of India: a « digital office » whose Chairperson and Members are appointed by the central government for two years (re-appointable), on the recommendation of selection committees chaired by the Cabinet Secretary (Chairperson) or the MeitY Secretary (Members). It inquires into breaches — within six months, extendable — and imposes penalties; appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days. After penalties in two or more cases, the Board may advise the government to block a platform.[1][2]
• Penalties set in the Schedule, up to ₹250 crore (₹2.5 billion) for failing to take security safeguards; the Board weighs gravity, duration, repetition, gain and mitigation. Sums go to the Consolidated Fund of India. The government may raise the amounts by notification, to no more than twice the original figures.[1]
• Consent managers: companies registered with the Board that let people give, manage, review and withdraw consent across data fiduciaries; they must be incorporated in India, have a net worth of at least ₹2 crore, act in a fiduciary capacity, be unable to read the data they route and keep consent records for at least seven years.[1][2]
• Transfers abroad allowed except to countries the government restricts by notification; the government may also set requirements for making data available to a foreign State.[1][2]
• Amendments to other laws: section 43A of the Information Technology Act, 2000 is omitted; and section 44(3) replaces clause (j) of section 8(1) of the Right to Information Act, 2005 — one of the exemptions from disclosure — with a single line exempting « information which relates to personal information ».[1]