Overview
DPDP Act, 2023 overview for Indian companies
The Act sets how organisations may process digital personal data in India and what individuals can ask of them. This page covers scope, roles, duties and rights.
Short answer
The DPDP Act, 2023 applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India (s.3). Under s.4, personal data may be processed only for a lawful purpose, with consent (s.6) or for a legitimate use (s.7). Data Fiduciaries carry most duties (s.8), and core obligations under the Rules begin on 13 May 2027 (Rule 1).
Who and what the Act covers (s.3)
The Act applies to digital personal data processed within India, whether it was collected in digital form or collected otherwise and then digitised (s.3). It also applies to processing outside India if that processing is connected with offering goods or services to Data Principals in India.
Section 3 leaves out:
- Processing for personal or domestic purposes.
- Personal data that the Data Principal has made publicly available.
- Personal data made publicly available by someone under a legal obligation to do so.
Section 17 adds exemptions. One that matters to many Indian service providers is s.17(1)(d): personal data of people outside India, processed in India under a contract with a person outside India. Check its scope with counsel before relying on it.
The roles the Act creates
| Role | Who it is (s.2, paraphrased) | Main provisions |
|---|---|---|
| Data Fiduciary | Any person who alone or with others decides the purpose and means of processing personal data | s.5 to s.10 |
| Data Principal | The individual the personal data relates to; includes the parents or lawful guardian of a child, and the lawful guardian of a person with disability | s.11 to s.15 |
| Data Processor | Any person who processes personal data on behalf of a Data Fiduciary | s.8(2) |
| Consent Manager | A person registered with the Board that lets a Data Principal give, manage, review and withdraw consent through one accessible, transparent and interoperable platform | s.6(7) to s.6(9), Rule 4 |
| Significant Data Fiduciary | A Data Fiduciary or class of Data Fiduciaries notified by the Central Government | s.10, Rule 13 |
| Data Protection Board | The Board established under s.18, which inquires into breaches and decides penalties | s.18 to s.28, s.33 |
Each term is set out in full on the definitions page.
Two lawful grounds: consent or a legitimate use (s.4)
Personal data may be processed only for a lawful purpose, and only with the Data Principal's consent (s.6) or for one of the legitimate uses listed in s.7 (s.4). There is no general “legitimate interest” ground.
Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6). Every consent request comes with a notice (s.5), which the person can read in English or any of the 22 languages in the Eighth Schedule (s.5(3)). See consent under section 6 and legitimate uses.
What a Data Fiduciary must do
- Give a notice with each consent request (s.5, Rule 3).
- Obtain valid consent and be able to prove notice and consent (s.6, s.6(10)).
- Use Data Processors only under a valid contract (s.8(2)).
- Keep data complete and accurate when it is used for a decision or disclosed (s.8(3)).
- Take reasonable security safeguards (s.8(5), Rule 6).
- Intimate the Board and each affected Data Principal of a breach (s.8(6), Rule 7).
- Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires retention (s.8(7)).
- Publish contact details and run effective grievance redressal (s.8(9), s.8(10)).
- Meet extra duties for children (s.9) and, if designated, as a Significant Data Fiduciary (s.10).
Each duty is mapped on duties of a Data Fiduciary.
What a Data Principal can ask for
- A summary of their personal data and its processing, and the identities of other fiduciaries and processors it was shared with (s.11).
- Correction, completion, updating and erasure of their personal data (s.12).
- Grievance redressal, which they must use before approaching the Board (s.13, s.13(3)).
- Nomination of another person to exercise their rights on death or incapacity (s.14).
Data Principals also have duties of their own under s.15. More on the rights of the Data Principal.
When it applies and who enforces it
The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025, with the commencement notification G.S.R. 843(E). Consent Manager registration starts on 13 November 2026, and core obligations begin on 13 May 2027 (Rule 1). The timeline lists what starts when.
The Data Protection Board of India (s.18) inquires into breaches and decides penalties. Appeals go to the Appellate Tribunal, the Telecom Disputes Settlement and Appellate Tribunal (s.29).
No Chairperson or Members of the Board have been appointed yet. The dates in Rule 1 do not depend on that, so plan for 13 May 2027.
How TruePrivacy helps
TruePrivacy gives a Data Fiduciary one place to run these duties. Data discovery finds personal data across databases, cloud stores and SaaS tools, and records of processing keeps processing activities in sync with what was found.
Consent management and notices cover s.5 and s.6, Data Principal rights and grievance redressal cover s.11 to s.14, and breach management tracks the Rule 7 clocks. A DPDP checklist and posture score shows your readiness from live records.
Does the DPDP Act apply to companies outside India?
Yes, when they process personal data outside India in connection with offering goods or services to Data Principals in India (s.3).
Does the DPDP Act cover data collected on paper?
It covers personal data collected in digital form, and personal data collected otherwise, for example on paper, and then digitised (s.3).
Is there a legitimate interest ground in the DPDP Act?
No. Processing needs consent (s.6) or one of the legitimate uses listed in s.7 (s.4).
When do the main DPDP obligations start?
On 13 May 2027, when Rules 3, 5 to 16, 22 and 23 come into force under Rule 1.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin