Background
What the Act is
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s primary statute for protecting digital personal data. It balances individuals’ rights as Data Principals with lawful processing by organisations acting as Data Fiduciaries. The Digital Personal Data Protection Rules, 2025 set out operational detail - notices, consent managers, security safeguards, breach intimation, and more.
Together, the Act and Rules create a citizen-centred framework: clear purpose, meaningful consent or other lawful grounds, reasonable security, rights fulfilment, and accountability before the Data Protection Board of India.
Key roles
- Data Principal - the individual to whom the personal data relates (including parents/guardians for children).
- Data Fiduciary - the entity that determines the purpose and means of processing personal data.
- Data Processor - processes personal data on behalf of a Data Fiduciary.
- Consent Manager - an accountable, India-incorporated intermediary enabling Data Principals to give, manage, review, and withdraw consent.
- Significant Data Fiduciary (SDF) - a fiduciary notified by the Central Government based on volume, sensitivity, risk to rights, and related factors - subject to additional duties.
Core obligations for Data Fiduciaries
- Issue clear, standalone consent notices stating purpose and use of personal data
- Process personal data only for the specified purpose, and cease when the purpose is no longer served
- Implement reasonable security safeguards to prevent personal data breach
- Intimate the Board and affected individuals of personal data breaches without delay, in plain language
- Honour Data Principal rights - access, correction, erasure, withdrawal of consent, and grievance redressal
- Meet heightened duties for children’s data (verifiable consent; restrictions on tracking and targeted advertising)
- Appoint contact persons and, for SDFs, independent data auditors and Data Protection Officers as applicable
Cross-border transfer
Transfer of personal data outside India is permitted unless the Central Government restricts transfer to a notified country or territory. Organisations should map outbound flows early and design contractual and technical controls accordingly.
How organisations should approach the Act
Treat DPDP as a security and control design problem. Legal text should become notice templates, consent state machines, retention clocks, access-control policies, breach runbooks, and evidence that survives Board scrutiny - not binders that drift from production reality.