The Digital Personal Data Protection Act, 2023, in outline

The Digital Personal Data Protection Act, 2023 received Presidential assent on 11 August 2023 and was published in the Gazette of India as Act No. 22 of 2023. It is a short statute by the standards of the field: forty-four sections in nine chapters, with a single Schedule listing the monetary penalties. Under Section 1(2), its provisions come into force on dates the Central Government appoints by notification, and different dates may be appointed for different provisions.

Scope

Section 3 applies the Act to the processing of digital personal data within India, whether the data was collected in digital form or digitised afterwards. It also reaches processing outside India where that processing is connected with offering goods or services to data principals within India. Personal data made publicly available by the data principal, or by someone else under a legal obligation, is excluded, as is data processed for personal or domestic purposes.

The roles the Act creates

The Act names the individual to whom personal data relates the data principal. The person who determines the purpose and means of processing is the data fiduciary; a person who processes on a fiduciary’s behalf is a data processor. Section 6 provides for consent managers, registered with the Data Protection Board of India, through whom a data principal can give, manage, review and withdraw consent. Section 10 allows the Central Government to notify a data fiduciary, or a class of them, as a Significant Data Fiduciary, which attracts additional obligations.

The obligations, in sequence

Sections 4 to 10 set out how personal data may be processed. Section 4 permits processing only for a lawful purpose, with consent or for one of the legitimate uses listed in Section 7. Section 5 requires a notice before or with the request for consent. Section 6 defines consent. Section 8 states the general obligations of a data fiduciary: accuracy where the data will be used to make a decision, reasonable security safeguards, breach intimation, erasure once the purpose is served, and a published contact for questions. Section 9 adds obligations for the data of children and of persons with disabilities. Section 10 sets the additional duties of a Significant Data Fiduciary.

Rights, duties and remedies

Sections 11 to 14 give the data principal rights: to access information about processing, to correction and erasure, to grievance redressal, and to nominate a person to exercise those rights in the event of death or incapacity. Section 15 places duties on the data principal, including not to register a false or frivolous grievance. Sections 18 to 28 establish the Data Protection Board of India, which inquires into breaches and imposes penalties under Section 33 and the Schedule. Section 29 provides an appeal to the Telecom Disputes Settlement and Appellate Tribunal.

What the Act leaves to the Rules

Much of the operating detail is delegated. Section 40 empowers the Central Government to make rules on, among other matters, the form of the notice, the registration of consent managers, the standards for verifiable consent of a parent, the time and form of breach intimation, and the procedure before the Board. Those matters are addressed in the Digital Personal Data Protection Rules, 2025, which the Forum covers in a separate note.

Back to the Bulletin, or read the standards.