The Digital Personal Data Protection Act 2023 is now India's foundational privacy law. Here is a practitioner's guide to understanding its obligations, rights, and enforcement landscape.
On August 11, 2023, India's Parliament passed the Digital Personal Data Protection Act (DPDPA) — a landmark legislation that fundamentally reframes how organisations collect, process, and store personal data of Indian citizens. For businesses operating in India or processing data of Indian residents, this is not a law you can defer. The clock is ticking.
The Act builds on global best practices — drawing from Europe's GDPR, India's own IT Act ecosystem, and the recommendations of the Justice Srikrishna Committee — while carving out uniquely Indian provisions around consent, deemed consent, and Significant Data Fiduciary (SDF) obligations.
"The DPDPA signals India's arrival as a mature data governance jurisdiction — one that balances the aspirations of a digital economy with meaningful protections for its 1.4 billion citizens."
What Is the DPDPA?
The DPDPA establishes a comprehensive legal framework for the processing of digital personal data. Unlike earlier drafts, the final Act is notably concise — 44 sections — but its implications are far-reaching. It applies to any entity (a "Data Fiduciary") that processes personal data of individuals ("Data Principals") located in India, whether processing occurs within India or abroad.
The Rights of Data Principals
One of the DPDPA's most citizen-friendly provisions is the suite of rights it grants to Data Principals. These rights mirror — and in some cases exceed — those seen in global frameworks:
| 01 | Right to access information about processing |
|---|---|
| 02 | Right to correction and erasure of personal data |
| 03 | Right to grievance redressal |
| 04 | Right to nominate (unique to DPDPA) |
| 05 | Right to withdraw consent at any time |
| 06 | Right to know about data processing purposes |
Notably, the Act introduces a right to nominate — unique to the Indian framework — allowing a Data Principal to nominate another individual to exercise rights on their behalf in the event of death or incapacity.
Consent: The Cornerstone of DPDPA Compliance
The DPDPA mandates that consent must be free, specific, informed, unconditional, and unambiguous — expressed through a clear affirmative action. A single notice must accompany the consent request, written in plain language, describing what personal data is sought, the purpose of processing, and how consent can be withdrawn.
The Act also recognises Deemed Consent — circumstances where processing can occur without explicit consent: voluntary sharing by the Data Principal, employment contexts, legal proceedings, public interest activities, and medical emergencies. Organisations must carefully map which activities fall under consent vs. deemed consent to avoid liability.
Significant Data Fiduciaries
Organisations classified as SDFs face enhanced obligations. In addition to standard fiduciary duties, they must:
SDF Obligations
- Appoint a Data Protection Officer (DPO) based in India, accountable to the Board of Directors.
- Engage an independent Data Auditor to conduct periodic audits of data processing activities.
- Conduct a Data Protection Impact Assessment (DPIA) for high-risk processing.
- Implement algorithmic accountability measures for automated decision-making systems.
Cross-Border Data Transfers
The DPDPA takes a permissive approach compared to GDPR. The Central Government will maintain a list of restricted countries — transfers to these are prohibited. All other jurisdictions are permissible by default. This "negative list" approach is a deliberate policy choice to enable India's data economy while protecting against geopolitical risk.
Data localisation requirements, prominent in earlier drafts, have been largely removed from the final Act. SDFs and certain sensitive categories may still face sector-specific localisation mandates under existing laws such as the RBI's payment data rules.
The Penalty Framework
The DPDPA's enforcement comes through a tiered penalty structure administered by the Data Protection Board of India (DPBI) — a quasi-judicial body with civil court powers:
₹250 Cr
Failure to implement reasonable security safeguards leading to a personal data breach
₹200 Cr
Failure to notify the Board and affected Data Principals of a breach
₹200 Cr
Non-compliance with additional obligations of Significant Data Fiduciaries
₹50 Cr
Violation of provisions related to children's personal data
Children's Data: Zero-Tolerance
The Act defines a child as any individual below 18 years of age. Processing children's personal data requires verifiable parental consent. Data Fiduciaries are prohibited from processing data in a manner likely to cause harm. Behavioural monitoring, targeted advertising directed at children, and tracking are all explicitly prohibited.
Global Lens: India Among Its Peers
India's DPDPA does not exist in isolation. Countries ranging from Senegal to Uruguay have enacted data protection regimes, while even economically powerful nations like the United States lack a comprehensive federal privacy law. India's law places it firmly in the ranks of jurisdictions with credible data governance — making Indian businesses more trustworthy partners for EU, UK, and Canadian entities that scrutinise data transfer adequacy.
Interestingly, while many developed/developing countries don't meet privacy guidelines, at least 23 under-developed nations have adopted data protection legislations. One classic example is Senegal — with 34% of its population living below the poverty line and 75% of its families suffering from chronic poverty, Senegal bolsters a robust data privacy regulation.
DPDPA Readiness Checklist for Organisations
Key Compliance Actions
- Map all personal data flows and identify processing activities requiring consent.
- Update privacy notices to be plain-language, purpose-specific, and DPDPA-compliant.
- Implement technical and organisational measures for data security (encryption, access controls).
- Establish a Data Breach Response Plan with 72-hour notification capability.
- Assess whether your organisation meets the SDF threshold and appoint a DPO if required.
- Audit children's data processing and implement parental consent verification.
- Review cross-border data transfer arrangements against the restricted-country list.
- Train employees on DPDPA obligations, data subject rights, and breach reporting.
Why DigiFortex for DPDPA Compliance?
Find Hidden PII Instantly · AI scans 16+ cloud & on-prem sources, detects 50+ data types before regulators do
Consent That Holds Up · Geo-smart banner auto-applies DPDPA or GDPR per visitor, full audit trail included
Close Rights Requests Fast · One admin queue handles access, deletion, correction & export in hours, not weeks
Know Every Cookie on Your Site · Headless browser engine classifies and flags violations automatically
Beat the 72-Hour Breach Clock · Auto-calculated deadlines, cryptographically signed notices, full lifecycle tracking
Live Compliance Score, Always · Real-time dashboard shows PII instances, risk severity & posture at a glance
Built for India, Mapped Globally · DPDPA-native with findings cross-mapped to GDPR, PDPA & more
Want this applied to your business?
30 minutes. A clear view of where you stand.
