The Digital Personal Data Protection Act is India's principal legislation governing the processing of digital personal data. For businesses, the law changes how customer, employee, user and other personal information must be collected, used, stored and shared. The framework is built around a balance between individual privacy and lawful use of data. The Act was enacted in 2023, while the Digital Personal Data Protection Rules, 2025 provide the operational framework for several obligations. Importantly, implementation is phased, so businesses need to distinguish between provisions already in force and provisions scheduled to commence later.This guide explains the law in practical language, with particular attention to what businesses need to understand before reviewing their privacy policies, contracts, technology systems and internal processes.

What Is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023, commonly called the DPDP Act, is India's dedicated statutory framework for digital personal data protection. Parliament enacted the legislation on 11 August 2023. Its stated purpose is to regulate the processing of digital personal data while recognising both an individual's right to protect personal data and the need for organisations to process information for lawful purposes. In practical terms, the law asks businesses to answer several basic questions. Why are you collecting someone's personal data? Have you provided an appropriate notice? Do you have a lawful basis for processing it? Are you collecting more information than necessary? Is the information secure? Can the individual exercise their statutory rights? What happens when the purpose for collection ends? These questions sit at the centre of the new compliance framework.

When Does the DPDP Act Apply?

The Act primarily concerns digital personal data. It applies to processing within India where personal data is collected in digital form. It also covers information collected in non digital form and subsequently digitised. The law can also apply outside India where processing is connected with offering goods or services to Data Principals in India. This means a foreign company serving Indian customers may need to consider the Indian framework even if its headquarters, servers or parent company are located overseas. There are exclusions. Personal data processed by an individual for a personal or domestic purpose falls outside the Act. Certain publicly available personal data is also excluded in circumstances specified by Section 3. The important point for businesses is scope. A company should assess its actual processing activities rather than assuming the law applies only to technology companies. A manufacturer with an employee database, an online retailer with customer accounts and a professional services firm managing client contacts can all have relevant processing activities.

The Three Main Players Under the DPDP Act

The Act uses terminology which businesses need to understand. A Data Principal is the individual to whom personal data relates. For a child, the statutory framework also recognises the parent or lawful guardian in the relevant context. A Data Fiduciary is the organisation or person deciding the purpose and means of processing personal data. This is broadly comparable to the concept of a data controller under some international privacy regimes, although the legal frameworks are not identical. A Data Processor processes personal data on behalf of a Data Fiduciary. For example, an online retailer may determine why customer information is collected and how it is used. The retailer may engage a cloud provider or software company to process the information. The retailer can therefore be the Data Fiduciary while the external service provider acts as a Data Processor. The distinction matters because responsibility does not disappear simply because processing is outsourced.

What Does “Processing” Mean?

Processing is broader than simply collecting information. The Act covers operations such as collection, recording, organisation, storage, adaptation, retrieval, use, sharing, disclosure, transmission, dissemination, restriction, erasure and destruction of digital personal data. This broad definition has practical consequences. A business processes personal data when a customer creates an account. It also processes data when the information is stored in a cloud platform, shared with a payment provider, accessed by customer support staff or deleted after the account is closed. Businesses therefore need to examine the complete data lifecycle.

Consent Under the DPDP Act

Consent is one of the most important concepts in the Act. Where consent is relied upon, it must be free, specific, informed, unconditional and unambiguous. It must involve a clear affirmative action and relate to the specified purpose for which the information is being processed. This means businesses should reconsider vague consent mechanisms. A pre selected box or a general statement hidden within lengthy terms may not provide the same level of clarity as an appropriately designed consent process. The Rules add further requirements around notices and consent mechanisms. Businesses should also remember one important point: consent is not necessarily required for every processing activity. The Act recognises specified legitimate uses and other statutory grounds. The correct approach is to identify the legal basis for each significant processing activity.

What Is a Privacy Notice?

A privacy notice tells the Data Principal how their information will be handled. The DPDP framework requires businesses to provide relevant information concerning processing. The 2025 Rules add detail regarding the manner in which notices should be presented. A good notice should be clear enough for an ordinary user to understand. It should not merely reproduce technical or legal terminology. It should explain the purpose of processing, the information involved and how the individual can exercise relevant rights. More importantly, the notice should accurately reflect the organisation's actual practices. If a company says information is used only to provide a service but its marketing team later uses the same information for unrelated advertising, the organisation may create a significant compliance gap.

Rights of Data Principals

The DPDP Act gives individuals specific rights concerning their personal data. These include rights relating to access to information about personal data, correction and erasure, grievance redressal and nomination. For businesses, these rights require operational processes. An organisation should know who receives a request, how the identity of the requester is verified, which department investigates it, how the response is prepared and how the action is recorded. This becomes particularly important for businesses handling large customer databases. A privacy policy may provide a contact address, but the organisation still needs an internal workflow capable of responding to legitimate requests. 

What Happens When a Person Withdraws Consent?

The Act provides individuals with the ability to withdraw consent. The withdrawal mechanism should be as easy as the mechanism through which consent was given. The consequences of withdrawal also need to be understood. If an individual withdraws consent, the business must assess whether another lawful basis permits continued processing. If not, relevant processing should cease and applicable erasure requirements should be considered. This is one reason consent management should be integrated with business systems rather than treated as a standalone legal document.

Special Rules for Children's Data

The DPDP Act gives children additional protection. A child is generally an individual who has not completed eighteen years of age. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian, subject to prescribed exemptions. The Act also restricts processing likely to cause a detrimental effect on a child's well being. It further restricts tracking and behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exemptions. For educational technology companies, gaming platforms, children's applications and other services likely to be used by minors, these provisions require specific attention.

Security Obligations Under the Act

A business cannot comply merely by obtaining consent. The Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches. The 2025 Rules provide additional detail regarding security safeguards, including measures relating to organisational and technical controls. Businesses should therefore examine access controls, authentication, encryption where appropriate, monitoring, security testing, incident management and vendor security. Security should be proportionate to the nature and volume of personal data involved. A company holding millions of customer records will generally require a more mature security programme than a small business maintaining a limited customer database. 

What Is a Personal Data Breach?

The Act defines a personal data breach broadly. It includes unauthorised processing and accidental or unlawful disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data which compromises its confidentiality, integrity or availability. This means a breach is not necessarily a dramatic cyberattack. An employee sending a customer database to the wrong recipient, unauthorised access to an internal system or accidental disclosure of information can potentially create a data protection incident. Businesses therefore need an internal reporting and response mechanism. Legal, security and management teams should know how an incident is escalated and what information needs to be preserved.

Data Retention and Erasure

The DPDP framework also addresses what happens when personal data is no longer required. Businesses should not treat every piece of information as an asset which must be stored indefinitely. Retention should be linked to the purpose for which the information was collected and any other legal requirement requiring continued retention. For example, a customer database may contain inactive accounts, old marketing records and information retained purely because no one has reviewed it. A proper retention schedule helps businesses identify information which should be removed. Deletion should also be considered across relevant systems, including third party platforms where applicable.

Significant Data Fiduciaries

The Act creates a special category known as a Significant Data Fiduciary. The Central Government may notify a Data Fiduciary or class of Data Fiduciaries as significant based on factors including the volume and sensitivity of personal data, risks to India's sovereignty and integrity, electoral democracy, security of the State, public order and other relevant considerations. Significant Data Fiduciaries have additional obligations. These include appointing a Data Protection Officer based in India, appointing an independent data auditor and conducting specified assessments and audits. Large digital platforms and organisations processing significant volumes of sensitive information should therefore monitor whether this category becomes relevant to them.

What Is the Data Protection Board of India?

The DPDP Act establishes the Data Protection Board of India. The Board is intended to serve as the principal enforcement and adjudicatory body under the framework. The Government established the Board as a body corporate under Section 18. The Board's role includes dealing with contraventions and matters connected with enforcement of the Act. The framework also provides an appeal mechanism. The Telecom Disputes Settlement and Appellate Tribunal is identified as the Appellate Tribunal under the Act. For businesses, this means data protection is no longer simply a matter of internal corporate policy. There is a statutory enforcement structure behind the obligations.

Penalties Under the DPDP Framework

The financial consequences can be substantial. The Schedule to the Act provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches. Certain breaches concerning notification of personal data breaches and children's data can attract penalties of up to ₹200 crore. Other specified breaches can attract penalties of up to ₹50 crore. These figures represent statutory maximums. They do not mean every breach results in the maximum penalty. The enforcement framework considers relevant circumstances when determining an appropriate penalty. Still, the potential exposure makes privacy governance a board level business concern for organisations handling substantial volumes of personal data.

How the DPDP Rules, 2025 Fit Into the Framework?

The Act establishes the legal framework. The Rules provide practical detail. The Government notified the Digital Personal Data Protection Rules, 2025 in November 2025. The Rules cover areas such as notice requirements, consent mechanisms, security safeguards, breach notifications, rights management, registration of Consent Managers and obligations relevant to Significant Data Fiduciaries. The Rules also provide a phased implementation period. This gives organisations time to adapt their systems. It does not mean businesses should wait until the final commencement date before starting their compliance work. Technology changes can take months. Contract revisions can take longer where multiple vendors or international group entities are involved.

Understanding the Phased Commencement

The DPDP Act does not become fully operational through a single commencement date. The Government's notification provides different commencement dates for different provisions. Sections 2, 18 to 26, 35 to 43 and specified parts of Section 44 commenced on 13 November 2025. Other provisions are scheduled to commence one year later, while the main operational provisions, including Sections 3 to 5 and Sections 7 to 17, are scheduled to commence eighteen months after 13 November 2025. This phased structure is important when writing internal compliance plans. A business should identify whether a requirement is currently operational, scheduled for commencement or already applicable through another existing law or sectoral regulation.

Does the DPDP Act Replace Every Other Privacy Requirement?

No. The DPDP framework needs to be read alongside applicable sectoral laws and regulations. Financial institutions, insurers, telecommunications companies, healthcare businesses and other regulated entities may have additional requirements concerning information security, outsourcing, technology systems and data management. The constitutional right to privacy also remains relevant. In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, the Supreme Court recognised privacy as a constitutionally protected right. The judgment remains an important part of India's broader privacy jurisprudence. Businesses should therefore avoid treating the DPDP Act as an isolated compliance exercise.

What Should Businesses Do Now?

The most useful starting point is a data inventory. A business should identify the personal data it collects, the purpose of collection, the systems in which it is stored, the people who can access it and the third parties who receive it. The organisation should then review its privacy notices and consent mechanisms. The next stage should involve vendor contracts. Cloud service providers, payroll companies, analytics platforms, customer relationship management systems and marketing providers can all form part of the data processing chain. Businesses should also establish a breach response procedure, a retention framework and a process for handling Data Principal requests. Finally, legal requirements should be mapped against actual technology. A privacy policy cannot protect a business if the application's underlying architecture collects or shares information in a different manner. Organisations handling substantial or complex data flows may also benefit from advice from top-rated data privacy lawyers, particularly where international transfers, children's data, technology vendors or regulatory investigations are involved. 

Why DPDP Compliance Is Also a Commercial Issue

Data protection affects more than regulatory risk. Investors may examine how a business acquired its customer database. Enterprise clients may ask for privacy warranties before signing a contract. Buyers conducting due diligence may review consent records, security incidents and vendor agreements before acquiring a company. A weak privacy framework can therefore create commercial friction. A mature data governance programme can make transactions easier because the business can demonstrate how personal information is collected, used, protected and deleted. This is especially relevant for companies planning international expansion. Businesses should also consider privacy when drafting technology contracts, employment documents and commercial agreements. A best corporate law firm can help integrate privacy obligations into wider corporate and contractual structures.

Conclusion

The Digital Personal Data Protection Act represents a significant development in India's privacy framework. It places greater responsibility on organisations which decide why and how digital personal data is processed. For businesses, the most important lesson is simple: privacy compliance should be built into operations rather than added after a problem occurs. Organisations should understand their data flows, establish appropriate legal bases for processing, provide meaningful notices, maintain suitable consent mechanisms, protect personal data, respect individual rights and establish procedures for breaches and deletion. The DPDP Rules, 2025 now provide much of the operational detail required to translate the Act into business practice. However, implementation is phased, so organisations should verify the commencement status of individual provisions before setting compliance deadlines. The official Digital Personal Data Protection Act, 2023 on India Code and DPDP Rules and official MeitY publications should remain the primary sources for checking the statutory text and current implementation position.

Frequently Asked Questions (FAQs)

Q1. What is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 is India's principal statutory framework for regulating the processing of digital personal data. It establishes obligations for Data Fiduciaries and rights for Data Principals, together with an enforcement mechanism and financial penalties.

Q2. Who needs to comply with the DPDP Act?

The Act can apply to organisations processing digital personal data in India and, in certain circumstances, organisations outside India offering goods or services to individuals in India.

Q3. Is consent always required under the DPDP Act?

No. Consent is one lawful basis for processing. The Act also recognises specified legitimate uses and other statutory circumstances. Businesses should assess the appropriate legal basis for each processing activity.

Q4. What is a Data Fiduciary?

A Data Fiduciary is an entity or person which determines the purpose and means of processing personal data.

Q5. What rights do individuals have under the DPDP Act?

Data Principals have rights relating to access to information, correction and erasure, grievance redressal and nomination, subject to the Act and applicable Rules.

Q6. Does the DPDP Act protect children's data?

Yes. Section 9 provides additional protection for children's personal data, including requirements concerning verifiable parental consent and restrictions on certain tracking, behavioural monitoring and targeted advertising activities.

Q7. What is the maximum penalty under the DPDP Act?

The highest scheduled penalty is up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches. Other contraventions have separate statutory maximums.

Q8. Does the DPDP Act apply to foreign companies?

It can apply where processing outside India is connected with offering goods or services to Data Principals in India.

Q9. What is a Significant Data Fiduciary?

It is a Data Fiduciary or class of Data Fiduciaries notified by the Central Government based on specified factors. Such entities face additional governance, audit and accountability obligations.

Q10. When should businesses begin preparing for DPDP compliance?

Businesses should begin preparation before the relevant provisions become operational. Data mapping, contract reviews, system changes and consent mechanisms can require considerable time.

This update was released on 28 Aug 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.