What Is DPDP?
LawThe Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's first comprehensive, standalone law governing how organisations process the personal data of individuals. It was passed by Parliament in August 2023. On its own, though, the Act sets out obligations without much procedural detail — the mechanics (how a Consent Manager registers, what a breach notification must contain, what "reasonable security safeguards" looks like in Rule form) come from the Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025.
"DPDP" as a shorthand usually refers to the Act and Rules together — that's how this guide uses it too, distinguishing between the two only where the distinction actually matters (for instance, a specific timeline detail almost always comes from the Rules, not the Act itself).
The Act and Rules aren't fully in force yet. They're commencing in three stages — the Board's establishment (November 2025, already in effect), Consent Manager registration (November 2026), and the Act's substantive obligations around consent, rights, and breach notification (May 2027). Chapter 18 on Implementation and our live status tracker go into this in more depth — the short version is that "not fully in force yet" is not a reason to wait before building your compliance programme.
Why DPDP Was Introduced
Before DPDP, India's main data-protection obligations sat inside Section 43A of the Information Technology Act, 2000 and the "Sensitive Personal Data or Information" (SPDI) Rules, 2011 — a narrower framework that only covered specific categories like financial information, health records, and passwords, and only applied to "body corporates," not government bodies. It also predates the Supreme Court's 2017 recognition of privacy as a fundamental right under Article 21 (Justice K.S. Puttaswamy v. Union of India), which is the constitutional backdrop DPDP was drafted against. DPDP replaces that older, narrower regime with a general-purpose law covering essentially any organisation that processes digital personal data of people in India, regardless of sector or company size.
Who Does DPDP Apply To?
LawDPDP applies to the processing of digital personal data — data that is already digital, or that was collected in non-digital form and later digitised. Under Section 3(b), it also reaches processing that happens outside India, where that processing is connected to offering goods or services to Data Principals located in India. In practice, that means an overseas SaaS company with Indian customers is very much in scope, even if it has no office or servers in the country.
There's no small-business carve-out based on company size or revenue — a five-person startup collecting emails through a signup form is a Data Fiduciary in exactly the same technical sense as a large enterprise, though the Act's additional obligations for Significant Data Fiduciaries (Chapter 13) only apply once the government specifically notifies an entity as one.
| Scenario | In scope? | Why |
|---|---|---|
| Indian e-commerce site collecting checkout details | Yes | Processing digital personal data of people in India |
| US-based SaaS tool with a free tier used by Indian signups | Yes | Offering services to Data Principals in India (Section 3(b)) |
| Paper feedback forms collected at a local store, never digitised | No | Not digital personal data unless and until digitised |
| An Indian company processing only its own employees' HR data | Yes | Still digital personal data of individuals; DPDP doesn't carve out employment data as a category |
Key Principles
PracticeUnlike the GDPR, the DPDP Act doesn't set out its principles in one dedicated article — they're implicit in the obligations spread across the Act's Chapter II (Sections 4 to 10). It's still useful to name them explicitly, because they're the "why" behind almost every specific rule later in this guide:
- Purpose limitation — data collected for a stated purpose shouldn't be silently reused for an unrelated one.
- Data minimisation — collect what a purpose genuinely requires, not everything that might be useful someday.
- Accountability — the Data Fiduciary is answerable for compliance even when processing is outsourced to a processor.
- Security by design — safeguards need to be in place before a breach happens, not assembled afterward.
- Transparency — a Data Principal should be able to understand, from the notice given, what's being done with their data and why.
Key Definitions
LawSection 2 of the Act defines these terms; Chapter 3 (DPDP Roles) covers the roles in depth, but here's the vocabulary you'll see from this point on:
| Term | Meaning |
|---|---|
| Data Principal | The individual the personal data is about — a customer, employee, or website visitor. |
| Data Fiduciary | The entity that decides the purpose and means of processing — usually, your organisation. |
| Data Processor | An entity processing data on a Fiduciary's behalf, under contract. |
| Consent Manager | A registered, interoperable platform through which a Data Principal can manage consent across multiple Fiduciaries at once. |
| Significant Data Fiduciary (SDF) | A Fiduciary the government notifies as carrying elevated obligations, based on factors like data volume and risk. |
| Personal data breach | Unauthorised processing, or accidental disclosure, loss, or destruction, that compromises confidentiality, integrity, or availability of personal data. |
DPDP Act vs. GDPR
DPDP is often compared to the EU's GDPR, since both are comprehensive, principles-driven data protection laws — but the differences matter more than the similarities once you're actually implementing something:
| DPDP Act, 2023 | GDPR | |
|---|---|---|
| Scope of data covered | Digital personal data only (or non-digital data later digitised) | All personal data, digital and structured non-digital |
| Sensitive data category | No separate "sensitive personal data" classification | Explicit "special category data" with extra safeguards |
| Lawful basis beyond consent | A closed list of "certain legitimate uses" (Section 7) | An open-ended "legitimate interest" balancing test |
| DPO requirement | Required only for Significant Data Fiduciaries | Required more broadly, based on processing type/scale |
| Maximum penalty | Up to ₹250 crore per instance, tiered by violation type | Up to 4% of global annual turnover |
Penalty figures per the Schedule to the DPDP Act, 2023, as summarised by dpdpa.com — treat this as a secondary-source summary and verify against the official Schedule before citing it in a legal context.
Assuming a GDPR-compliant consent flow automatically satisfies DPDP, or vice versa. The two laws overlap heavily in spirit but differ in specific mechanics — DPDP's narrower "legitimate uses" list in particular means some GDPR "legitimate interest" processing has no direct DPDP equivalent and may need actual consent instead.