What is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023 ("DPDP Act") is India's dedicated data protection law. It sets the rules for how organisations may collect, store, use and share the digital personal data of individuals, and gives those individuals enforceable rights over their own data. It is overseen by the Data Protection Board of India, which can investigate complaints and impose penalties.
In simple terms: if your business holds people's names, phone numbers, emails, identity documents, health or financial details, or any other data that can identify a person, the DPDP Act applies to you.
Key terms, in plain language
Data Principal
The individual the personal data is about — your customer, employee, user or patient.
Data Fiduciary
The organisation that decides why and how personal data is processed — usually you.
Data Processor
A third party that processes data on your behalf — a cloud host, payroll vendor, SaaS tool.
Personal Data
Any data about an identifiable individual — directly or in combination with other data.
Consent
A free, specific, informed, unambiguous "yes" for a stated purpose — easy to give and to withdraw.
Significant Data Fiduciary (SDF)
A larger or higher-risk Fiduciary notified by the government, with extra obligations.
Who must comply?
Almost everyone. The Act applies to any organisation processing the digital personal data of individuals in India — regardless of size or sector — and even to some processing outside India that relates to offering goods or services to people in India. Start-ups, hospitals, schools, NBFCs, e-commerce, SaaS, manufacturers with HR data — all are covered.
The rights your customers now have
The DPDP Act gives every Data Principal enforceable rights. You must be able to honour each of them:
- Right to access — a summary of the personal data you hold about them and how it's processed.
- Right to correction & completion — fix inaccurate or incomplete data.
- Right to erasure — delete their data when it's no longer needed.
- Right to grievance redressal — a proper channel, answered within set timelines.
- Right to nominate — nominate someone to exercise their rights if they die or are incapacitated.
Your main obligations as a Data Fiduciary
| Obligation | What it means in practice |
|---|---|
| Valid consent & notice | Collect data only with clear, purpose-wise consent, preceded by a plain-language notice — available in English and the languages of the Eighth Schedule. |
| Purpose limitation | Use the data only for the purpose consented to; delete it when that purpose ends. |
| Security safeguards | Protect personal data with reasonable technical and organisational measures — encryption, access control, masking. |
| Breach notification | Notify the Data Protection Board and affected individuals of a personal-data breach. |
| Honour rights | Enable access, correction, erasure, grievance redressal and nomination. |
| Processor contracts | Engage processors only under a valid contract (Data Processing Agreement). |
| Children's data | Verifiable parental consent for under-18s; no tracking or targeted advertising to children. |
Are you a Significant Data Fiduciary (SDF)?
The government can notify certain Fiduciaries as SDFs based on data volume, sensitivity of the data, risk to individuals, and cross-border transfer. SDFs carry heavier duties:
- Appoint a resident Data Protection Officer (DPO) based in India.
- Appoint an independent data auditor and undergo periodic audits.
- Carry out Data Protection Impact Assessments (DPIAs) for high-risk processing.
What are the penalties?
The Data Protection Board of India can impose significant financial penalties — up to ₹250 crore for a single failure to take reasonable security safeguards to prevent a breach, and other substantial amounts for other failures (breach notification, children's-data duties, SDF duties, and more). Beyond the fine, a breach carries reputational damage and loss of customer trust.
How to get compliant
Compliance is a programme, not a checkbox. In practice it means discovering where personal data lives, mapping how it flows, protecting sensitive identifiers, rebuilding consent and notices, standing up rights and breach processes, training your people, and keeping evidence you can show an auditor. DPDP Bridge does all of this with you — legal and technology together, end to end — in a structured 10–12 week programme, then keeps you compliant as the Rules evolve.