Digital Personal Data Protection Act, 2023
India · Law · Ministry of Law and Justice, Government of India
High impact. A reviewer confirms each change before it is listed here.
Our summary
This law regulates the processing of digital personal data in India, establishing rights for individuals to protect their personal information and establishing rules for lawful processing. It requires organisations to obtain informed consent from individuals before processing their data, with limited exceptions for certain legitimate uses. The Act creates a Data Protection Board of India to oversee compliance and establish standards for data handling.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
9 sections
Jump to a chapter
Chapter I Preliminary
The Digital Personal Data Protection Act, 2023 enters force on dates set by the Central Government for each provision and applies to digital personal data processing within India and to processing outside India relating to offering goods or services to Indian Data Principals, but not to personal data processed by individuals for personal or domestic purposes or data publicly made available by the Data Principal or someone legally obligated to publish it. Key terms defined include Data Principal (individual whose data is processed, or their guardian if a child or person with disability), Data Fiduciary (person determining processing purpose and means), Consent Manager (registered intermediary for consent management), and Data Processor (processes data for a Data Fiduciary).
Chapter II Obligations of data fiduciary
Data Fiduciaries must process personal data only for lawful purposes based on the Data Principal's consent (which must be free, specific, informed, unconditional, unambiguous, and involve clear affirmative action in English or Eighth Schedule languages) or legitimate uses including specified purposes, State-prescribed benefits, State functions affecting sovereignty or security, disclosure obligations, court orders, medical emergencies, public health threats, disaster safety, or employment purposes, with notice and proof of compliance; they must comply regardless of agreements or the principal's failures, stop processing if consent is withdrawn unless otherwise required by law, ensure data completeness and accuracy when it affects principals, and obtain verifiable consent from parents or guardians for children or persons with disabilities, prohibiting processing likely to cause detriment to children's well-being or targeting children with tracking, monitoring, or directed advertising except as prescribed.
Chapter III Rights and duties of data principal
Data principals have rights to request a summary of their personal data and processing activities, identities of fiduciaries and processors who received their data, and other prescribed information, except where sharing with law-enforcement-authorized fiduciaries for crime prevention, detection, investigation or prosecution is involved; they may also request correction, completion, updating or erasure of their personal data, which fiduciaries must do for inaccurate data unless retention is legally required. Data principals may nominate another individual to exercise their rights after death or incapacity (inability to exercise rights due to unsoundness of mind or infirmity). Data principals must comply with applicable laws, not impersonate others, not suppress material information on identity or address documents, not file false grievances, and provide only verifiably authentic information when exercising correction or erasure rights.
Chapter IV Special provisions
The Central Government may restrict personal data transfers outside India by notification. Chapter II (except subsections 1 and 5 of section 8), Chapter III, and section 16 do not apply where processing is necessary for legal rights, judicial functions, crime prevention and prosecution, processing data of foreign principals under contract, corporate restructuring approved by courts, or assessing defaulters' financial information under insolvency law. State instrumentalities' processing for sovereignty, state security, public order or preventing cognizable offences is exempt from the Act; processing for research, archiving or statistics not involving individual decisions is allowed under prescribed standards.
Chapter V Data protection board of india
A Data Protection Board of India is established as a body corporate with perpetual succession and powers to acquire property, contract and sue, comprising a Chairperson and other members appointed by the Central Government with headquarters at a notified location; members must possess special knowledge or experience in data governance, law, technology, consumer protection or related fields, with at least one law expert. Chairperson and Members must not accept employment for one year after leaving office without Central Government approval and must disclose subsequent employment with Data Fiduciaries against whom they initiated proceedings. Board proceedings remain valid despite vacancies, defects in constitution or appointment, or procedural irregularities not affecting case merits, and Board Members are deemed public servants under the Indian Penal Code.
Chapter VI Powers, functions and procedure to be followed by board
The Board inquires into personal data breaches, Data Fiduciary and Consent Manager obligation breaches, Consent Manager registration condition breaches, and intermediary violations; directs remedial measures; imposes penalties; and may issue binding directions to persons after hearing them. The Board may modify, suspend, withdraw or cancel its directions with conditions. The Board functions as a digital office following natural justice principles; has civil court powers to summon, examine witnesses, receive evidence, and inspect data and documents; may require police or government officer assistance; issues interim orders after hearing; and determines whether complaints have sufficient grounds to proceed or are false or frivolous, imposing costs on complainants as appropriate.
Chapter VII Appeal and alternate dispute resolution
Aggrieved persons may appeal Board orders to the Appellate Tribunal within 60 days, extendable for sufficient cause, and Tribunal decisions must be made within 6 months and are executable as civil court decrees. Voluntary undertakings bar further Board proceedings regarding their contents unless breached, in which case the Board may proceed against the breach as a statutory violation after giving the person a hearing opportunity.
Chapter VIII Penalties and adjudication
The Board may impose monetary penalties specified in the Schedule if it finds significant breach after hearing the person, considering factors such as breach nature and gravity, data affected, repetition, financial gain or loss avoided, mitigation efforts, penalty proportionality and effectiveness, and impact on the person. Penalty sums go to India's Consolidated Fund.
Chapter IX Miscellaneous
The Central Government, Board, its chair, members and staff are immunised from legal proceedings for actions done in good faith under this Act or rules; the Government may require information from the Board, Data Fiduciaries and intermediaries, and after the Board reports a Data Fiduciary incurred monetary penalties twice or more, may direct agencies or intermediaries to block public access to information enabling that Data Fiduciary to offer goods or services in India, with prior hearing and written reasons. The Government may make rules on notice procedures, Consent Manager obligations and registration, children's data processing, breach notification, Data Protection Impact Assessment, Data Principal requests, grievance timelines, Board composition and other Act matters; rules and certain notifications must be laid before Parliament for thirty days and have no effect if both Houses object or amend before the next session ends, the Government may amend the Schedule by notification but cannot increase any penalty beyond twice its original amount, and may make orders to remove implementation difficulties within three years of commencement. Penalties are up to 250 crore rupees for failing reasonable security safeguards, 200 crore for not notifying breach, 200 crore for breaching child protection obligations, 150 crore for Significant Data Fiduciary breaches, 10,000 rupees for section 15 violations, extent applicable for voluntary undertaking proceedings breaches, and 50 crore for any other Act or rules breach.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.