Lesson 1
Why India enacted the DPDP Act
In 2017 a nine-judge bench of the Supreme Court of India held, in Justice K.S. Puttaswamy (Retd.) v. Union of India, that the right to privacy is a fundamental right protected by the Constitution. The judgment recognised that privacy includes a person's interest in information about herself, and it gave fresh momentum to the case for a dedicated Indian law on personal data. The Digital Personal Data Protection Act, 2023 is that law.
Before the Act, an important statutory provision on compensation for negligent handling of personal data sat in the Information Technology Act, 2000, as Section 43A. The DPDP Act replaces that approach with a regime of its own. Section 44 omits Section 43A from the IT Act, and that amendment takes effect on 13 May 2027, when the DPDP Act's own breach and penalty provisions take over.
The Act was published in the Gazette of India on 11 August 2023 as Act No. 22 of 2023. It has 44 sections arranged in nine chapters. In broad terms it sets out who may process digital personal data and on what grounds, the duties of the organisations that decide why and how data is processed, the rights and duties of the individuals the data is about, and a Data Protection Board of India with power to inquire into breaches and impose monetary penalties.
The Act does not try to carry every detail itself. Section 40 lets the Central Government make rules to carry out its purposes, and the Digital Personal Data Protection Rules, 2025, published on 13 November 2025 as G.S.R. 846(E), are that power in use. Throughout this course you will see Rules referred to by number, for example Rule 3 on the form of a notice and Rule 6 on security safeguards, wherever they add detail to a section of the Act.
The Act also sits alongside other Indian laws rather than replacing them. Section 38 says it is in addition to, not in derogation of, any other law in force, and that it prevails only to the extent of a genuine conflict. A bank, hospital or telecom operator therefore has to read the DPDP Act together with its own sectoral rules.
Enforcement under the Act is monetary. The Board can impose penalties up to the maximums in the Schedule to Section 33, the highest being up to ₹250 crore for failing to take reasonable security safeguards. The Act creates no criminal offence or imprisonment of its own.
- The Supreme Court recognised privacy as a fundamental right in the Puttaswamy judgment of 2017.
- The Act is No. 22 of 2023, published on 11 August 2023, with 44 sections in nine chapters.
- The DPDP Rules, 2025 (G.S.R. 846(E)) are made under Section 40 and add detail to the Act.
- Section 38 makes the Act additional to other laws; it prevails only where there is a real conflict.
- Penalties are monetary, imposed by the Data Protection Board; the Act creates no criminal offence.
Lesson 2
How the Act comes into force: three phases
An Act of Parliament does not always take effect all at once. Section 1(1) gives the Act its short title, and that took effect on enactment on 11 August 2023. Section 1(2) is the commencement power: it lets the Central Government appoint, by notification, the dates on which the Act's provisions come into force, with different dates for different provisions. Until a provision has been notified as commenced, it binds no one.
The Central Government used that power in the commencement notification G.S.R. 843(E), dated 13 November 2025, the same day the DPDP Rules, 2025 were published. It divides the Act into three groups, and the split does not follow the chapters in the way a reader might expect. It is worth learning the three dates: 13 November 2025, 13 November 2026 and 13 May 2027.
The first group has been in force since 13 November 2025. It contains Section 1(2), the definitions in Section 2, the provisions that establish and organise the Data Protection Board in Sections 18 to 26, the good-faith protection in Section 35, Sections 38 to 43 (consistency with other laws, bar of jurisdiction, the rule-making power, laying of rules before Parliament, the power to amend the Schedule and the power to remove difficulties), and Section 44(1) and (3), which amend the TRAI Act and the Right to Information Act. These are mostly structural and administrative provisions.
The second group is not yet in force. It commences on 13 November 2026, one year after the Rules were published, and contains just two provisions: Section 6(9), which requires every Consent Manager to be registered with the Board, and Section 27(1)(d), the Board's power to act on a Central Government reference about an intermediary breaching Section 37(2).
The third group is also not yet in force. It commences on 13 May 2027, eighteen months after the Rules were published, and contains nearly every substantive obligation: the territorial scope in Section 3, the grounds for processing in Section 4, notice in Section 5, the rest of the consent rules in Section 6, legitimate uses in Section 7, the general obligations in Section 8 (including security safeguards and breach notification), children's data in Section 9, Significant Data Fiduciaries in Section 10, the rights and duties of Data Principals in Sections 11 to 15, cross-border transfer and exemptions in Sections 16 and 17, the rest of Section 27, Sections 28 to 34 on inquiry, appeal and penalties, Sections 36 and 37, and Section 44(2), which amends the IT Act.
The practical point is that publication of the Rules on 13 November 2025 did not switch on the main compliance duties. The operative compliance chapters, Chapters II and III, start on 13 May 2027. A Rule that elaborates one of those sections, such as Rule 3 on notice or Rule 7 on breach reporting, adds detail to an obligation that itself starts on that date. Organisations are expected to use the period before then to prepare.
- Section 1(2) lets the Central Government commence different provisions on different dates; G.S.R. 843(E) is the notification that does so.
- In force since 13 November 2025: Section 1(2), the definitions in Section 2, the Board provisions in Sections 18 to 26, Section 35, Sections 38 to 43, and Section 44(1) and (3).
- From 13 November 2026 (not yet in force): Consent Manager registration under Section 6(9) and the Board power in Section 27(1)(d).
- From 13 May 2027 (not yet in force): nearly every substantive duty, including scope, notice, consent, security, breach notification, children's data, rights and penalties.
Section 1Section 2Section 3Section 6Section 18Section 27Section 33Section 44
Lesson 3
Key definitions: the parties the Act names
Section 2 defines around two dozen terms that the rest of the Act relies on. It sets no obligation of its own, but every duty elsewhere in the Act has to be read through these definitions, and getting a definition wrong usually means getting the obligation wrong. Section 2 has been in force since 13 November 2025.
The Data Principal is the individual to whom the personal data relates. The definition is extended in two cases. Where the individual is a child, the Data Principal includes her parent or lawful guardian. Where the individual is a person with disability, it includes her lawful guardian. For these purposes a child is anyone under 18 years of age, which is why Section 9's rules on verifiable parental consent reach teenagers as well as younger children.
The Data Fiduciary is any person who, alone or together with other persons, determines the purpose and means of processing personal data. Put simply, it is whoever decides why and how the data is processed. Size makes no difference, and neither does whether the Data Fiduciary does the processing itself or hands it to a vendor. Most of the Act's obligations sit with the Data Fiduciary, and under Section 8(1) it stays responsible for compliance whatever any contract says.
The Data Processor is a person who processes personal data on behalf of a Data Fiduciary. Typical examples are a cloud host, a payroll vendor or an outsourced support desk. Under Section 8(2) a Data Fiduciary may engage a Data Processor only under a valid contract, and the Data Fiduciary remains accountable for what its processors do.
A Consent Manager is an entity through which a Data Principal can give, manage, review and withdraw her consent. A Consent Manager is accountable to the Data Principal. Section 6(9) requires every Consent Manager to be registered with the Data Protection Board, but that requirement is not yet in force: it commences on 13 November 2026.
One more term to recognise early is the Significant Data Fiduciary. This is a Data Fiduciary, or class of them, that the Central Government notifies as significant, based on factors such as the volume and sensitivity of the data processed and the risk to Data Principals. It is a designation made by the government, not a status an organisation assesses for itself, and it carries the extra duties in Section 10, which commence on 13 May 2027.
- Data Principal: the individual the data is about, including a child's parent or lawful guardian and a person with disability's lawful guardian.
- Child: anyone under 18.
- Data Fiduciary: whoever, alone or with others, determines the purpose and means of processing; size is irrelevant.
- Data Processor: processes personal data on behalf of a Data Fiduciary, and may be engaged only under a valid contract.
- Consent Manager: lets a Data Principal give, manage, review and withdraw consent; registration with the Board is required from 13 November 2026.
Lesson 4
Key definitions: personal data, processing and breach
Personal data means any data about an individual who is identifiable by or in relation to that data. The test is identifiability, not the type of information. A name, phone number, email address, device identifier or account number all count as personal data when they can be tied back to a person. Data about a company as such is not personal data, but data about the individuals who work for it can be.
The Act is concerned with digital personal data. That covers personal data collected in digital form, and personal data collected in non-digital form, for example on a paper form, and digitised afterward. Once a paper record is scanned or keyed into a system, the Act can reach it. A paper record that is never digitised is outside the Act.
Processing is defined very broadly. It means an operation or set of operations performed on personal data, wholly or partly by automated means, and it includes collection, recording, storage, organisation, retrieval, use, combination, sharing, disclosure, restriction, and erasure or destruction. Because storage and erasure are themselves processing, an organisation that merely keeps data in an archive is still processing it. If your systems touch the data, you should assume you are processing it.
A personal data breach is the event the Act's security provisions are built around. Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent one. Section 8(6) requires it, if a breach occurs, to notify the Board and every affected Data Principal. Rule 7 of the DPDP Rules, 2025 adds that a fuller report covering the cause, impact and mitigation must reach the Board within 72 hours of the Data Fiduciary becoming aware of the breach. These duties are not yet in force: they commence on 13 May 2027.
The breach provisions carry the Act's largest penalties. Failing to take reasonable security safeguards can draw a penalty of up to ₹250 crore, and failing to notify a breach up to ₹200 crore, under the Schedule to Section 33. That is one reason the definitions of personal data and processing matter so much in practice: they decide which systems and records fall inside the security and breach duties.
- Personal data is any data about an individual who is identifiable by or in relation to it.
- The Act covers data collected digitally and data collected on paper and digitised later; paper that is never digitised is outside it.
- Processing includes almost every operation, from collection and storage to sharing and erasure.
- Breach duties (prevent under Section 8(5), notify under Section 8(6), Rule 7 report within 72 hours) commence on 13 May 2027.
Lesson 5
Where the Act applies, and what it leaves out
Section 3 sets the Act's scope. It is not yet in force: like the other substantive provisions, it commences on 13 May 2027. Once it does, it fixes scope along two lines: the form of the data and where the processing happens.
The Act applies to the processing of digital personal data within India, whether the data was collected in digital form or collected in non-digital form and digitised afterward. Any organisation processing such data in India is within its reach.
The Act also applies to processing of digital personal data outside India, but only where that processing is in connection with offering goods or services to Data Principals in India. Where an organisation's servers or legal entity sit does not change the answer. A company abroad that sells to people in India through an app or website is covered for that processing. Processing outside India that has no such connection is outside the Act.
Section 3 then excludes two kinds of processing entirely. The first is personal data processed by an individual for a purely personal or domestic purpose, such as a personal contact list or family photographs kept for oneself. This exclusion covers an individual acting for herself. It does not cover anything done in a business or organisational capacity, even by a sole trader using a personal phone.
The second exclusion is personal data that is made publicly available by the Data Principal to whom it relates, or by another person who was under a legal obligation to make it public. The wording matters. It does not cover data that a Data Fiduciary or anyone else simply chose to publish, so finding personal data on the internet does not by itself take it outside the Act.
Do not confuse these Section 3 exclusions with the exemptions in Section 17. The Section 3 exclusions mean the Act does not apply at all. Section 17 provides narrow, purpose-bound exemptions from particular obligations, several of which depend on a government notification, and even the Section 17(1) exemptions leave in place the accountability duty in Section 8(1) and the security safeguards duty in Section 8(5).
- Section 3 commences on 13 May 2027 and is not yet in force.
- The Act covers digital personal data processed in India, and processing outside India connected with offering goods or services to Data Principals in India.
- Processing by an individual for a purely personal or domestic purpose is excluded; business use is not.
- Data made public by the Data Principal herself, or by someone legally obliged to publish it, is excluded; data someone merely chose to publish is not.
- Section 3 exclusions take data outside the Act altogether; Section 17 exemptions are narrower and specific.
Lesson 6
The DPDP Act and the GDPR: a conceptual comparison
Many organisations that handle Indian personal data also deal with the European Union's General Data Protection Regulation (GDPR). The two laws share a broad vocabulary, and a GDPR programme can be a useful starting point, but they are not the same and one should not be assumed to satisfy the other. This lesson compares them at the level of concepts only.
The roles map reasonably closely. The DPDP Act's Data Fiduciary corresponds to the GDPR's controller, the Data Processor to the processor, and the Data Principal to the data subject. One difference in the DPDP definition is that the Data Principal expressly includes a child's parent or lawful guardian and a person with disability's lawful guardian.
Scope differs. The DPDP Act covers digital personal data only: data collected digitally, or collected on paper and digitised later. The GDPR is not confined to digital records in the same way and can also reach personal data kept in structured manual filing systems.
The GDPR creates special categories of personal data, such as health or biometric data, with stricter conditions for processing them. The DPDP Act has no equivalent separate tier. The same grounds apply to all personal data, although the sensitivity of the data is one of the factors the Board must weigh when fixing a penalty under Section 33, it is one of the factors the government may consider when notifying a Significant Data Fiduciary under Section 10, and children's data has its own rules in Section 9.
The lawful grounds are also narrower. Under Section 4 of the DPDP Act, personal data may be processed only on the Data Principal's consent or for one of the legitimate uses listed in Section 7, and that list is complete. There is no general legitimate interests ground of the kind the GDPR includes among its lawful bases.
Penalties are structured differently. The DPDP Act sets fixed maximum amounts in rupees in the Schedule to Section 33, from up to ₹10,000 for a Data Principal breaching her duties to up to ₹250 crore for failing to take reasonable security safeguards. Under Section 42 the Central Government may raise these figures by notification, but never beyond double the original amounts. The GDPR's maximum fines, by contrast, can be calculated as a percentage of an organisation's worldwide annual turnover. Under the DPDP Act, penalties are imposed by the Board after an inquiry and a hearing.
- Data Fiduciary, Data Processor and Data Principal correspond broadly to the GDPR's controller, processor and data subject.
- The DPDP Act covers digital personal data only.
- The DPDP Act has no separate special categories of personal data; children's data has its own rules in Section 9.
- Processing needs consent or a Section 7 legitimate use; there is no general legitimate interests ground.
- Penalties are fixed rupee maximums in the Schedule to Section 33, not a percentage of turnover.
Section 2Section 3Section 4Section 7Section 9Section 10Section 33Section 42
Check yourself
5 random questions from this module. Answers are marked straight away and don't count toward the exam.