DPDP Act 2023: a plain-language guide
Short answer: The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's data protection law. Any business that handles digital personal data of people in India must have a lawful reason, usually consent, give a clear notice, keep the data secure, report breaches and respect people's rights. Penalties can reach ₹250 crore for a single failure.
What is the DPDP Act?
The DPDP Act was passed by Parliament in August 2023. It sets the rules for how organisations collect and use digital personal data, meaning any data about an identifiable person that is collected in digital form, or collected on paper and later digitised. The Digital Personal Data Protection Rules, 2025, notified in November 2025, fill in the detail and phase obligations in over time, with most duties for businesses applying 18 months after notification.
Who does the DPDP Act apply to?
It applies to processing of digital personal data within India, and to processing outside India when it is connected to offering goods or services to people in India. In practice, if your app, website or business handles customer, employee or user data in India, it applies to you, whatever your size.
The Act uses its own terms:
- Data Fiduciary: the organisation that decides why and how personal data is processed (your business).
- Data Principal: the person the data is about (your customer, user or employee).
- Data Processor: a vendor that processes data on your behalf, such as a cloud or email provider.
- Significant Data Fiduciary: an organisation the government names because of the volume or sensitivity of the data it handles. It has extra duties, such as a Data Protection Officer based in India, periodic audits and data protection impact assessments.
What are the main obligations under the DPDP Act?
- Consent or a legitimate use. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, and as easy to withdraw as to give. The Act also lists certain legitimate uses where consent is not needed, such as data a person gives voluntarily for a specific purpose.
- Notice. Tell people, in clear language, what data you collect, why, and how they can use their rights and complain.
- Security safeguards. Take reasonable security measures to prevent personal data breaches, including through your processors.
- Breach reporting. If a breach happens, inform the Data Protection Board of India and each affected person.
- Accuracy and deletion. Keep data accurate when it is used for decisions, and erase it when the purpose is served or consent is withdrawn, unless a law requires you to keep it.
- Grievance redressal. Publish a contact for questions and complaints and respond to them.
What does the DPDP Act say about children's data?
A child under the Act is anyone under 18. You need verifiable consent from a parent or lawful guardian before processing a child's data, and you must not track, behaviourally monitor or target advertising at children, subject to exemptions set out in the Rules.
What rights do people have under the DPDP Act?
A Data Principal can ask what data you hold about them and how it is used, ask you to correct, complete, update or erase it, have their grievance addressed, and nominate someone to exercise these rights if they die or become unable to.
What are the DPDP Act penalties?
The Data Protection Board of India can impose financial penalties. The highest, up to ₹250 crore, is for failing to take reasonable security safeguards to prevent a breach. Failing to notify a breach and breaking the rules on children's data can each cost up to ₹200 crore.
DPDP Act starter checklist
- Make a list of the personal data you collect, where it is stored and who can access it.
- Write down the purpose and lawful basis for each type of data.
- Update your privacy notice and consent screens in plain language.
- Make withdrawing consent as easy as giving it.
- Set up a process to answer access, correction and deletion requests.
- Publish a grievance contact.
- Review contracts with vendors that process data for you.
- Put basic security in place: MFA, encryption, access reviews, backups and logging.
- Write a breach response plan, including how you will notify the Board and affected people.
- Set retention periods and delete data you no longer need.
How ExpertComply helps with the DPDP Act
ExpertComply GRC includes a DPDP Act 2023 checklist that turns the law into plain tasks you can tick off, with evidence attached and progress you can show to customers and investors. Privacy policy and assessment templates help you get the documents right, and the advisor answers "does this apply to us?" questions in everyday language. ExpertComply VAPT helps with the "reasonable security safeguards" duty by scanning your code and website for weaknesses.
This guide is general information, not legal advice. For decisions about your specific situation, speak to a qualified lawyer.
See plans Ask for a walkthrough