No matching DPDP resources found.
Try searching for "consent", "penalty", or check our Glossary.
Read the verified legal text, understand each provision in plain language, and move directly from law to implementation.
What this means: This section simply gives the law its official name: The Digital Personal Data Protection Act, 2023. It also states that the gover...
What this means: This section defines all the important legal terms used in the Act. Important Definitions:- Data Principal: You (the person the da...
Who this applies to: This defines the scope of the DPDP Act. Key Takeaways:1. It applies to digital data collected in India (or physical data that ...
What this means: A company can only process your data if they have a legal reason to do so. This legal reason must be either:1. You gave them your ...
What this means: Before a company asks for your consent, they must give you a clear "Notice".The Notice Must Tell You:- Exactly what data they want...
What this means: Consent must be real. It cannot be forced or hidden in complex terms and conditions. A company can only ask for data that is stric...
What this means: In specific situations, companies or the government do not need to ask for your explicit consent to process your data. This is cal...
What this means: This is the most critical section for companies, establishing their core responsibilities.Company Obligations:- They must use a le...
What this means: The law provides strict safeguards for children (under 18).Key Rules:- Companies must obtain "verifiable consent" from parents bef...
What this means: Large technology companies (like major social media networks or banks) that process huge volumes of data or pose a risk to the nat...
Your Rights: You have the right to ask any company what data they hold on you. You can demand:1. A summary of the data they are processing.2. A lis...
Your Rights (Right to be Forgotten): You have the right to control the accuracy and existence of your data.You can ask a company to:- Fix any wrong...
Your Rights: If a company misuses your data, you have the right to complain.Companies must provide an easy-to-use grievance mechanism. However, you...
Your Rights: You can nominate someone (like a family member) to manage, access, or delete your digital personal data in the event of your death or ...
Your Duties: While the law gives you rights, it also requires you to act responsibly.You must:- Not use fake identities or impersonate others.- Not...
What this means: The Indian government has the power to create a "blacklist" of countries. Companies are not allowed to transfer Indian citizens' d...
What this means: This section lists the situations where the strict rules of the DPDP Act do not apply.Major Exemptions:- Courts, law enforcement, ...
What this means: This creates a new national regulatory body: The Data Protection Board of India. This Board is responsible for enforcing the Act, ...
What this means: The Board will be led by a Chairperson and several Members appointed by the Central Government. They must be experts in fields lik...
What this means: Board members serve for a term of 2 years and can be re-appointed. Their salaries cannot be maliciously reduced to force them out ...
What this means: The Chairperson is the ultimate administrative head of the Data Protection Board and decides which members or groups handle specif...
What this means: The Board has the power to:- Force a company to take urgent action to stop an ongoing data breach.- Investigate complaints from ci...
What this means: The Board operates primarily as a "digital office", meaning hearings and complaints are handled online to maximize speed and effic...
What this means: If a company (or a citizen) is unhappy with a penalty or decision handed down by the Data Protection Board, they have 60 days to f...
What this means: Instead of going through a long, formal legal proceeding, the Board can force a company and a citizen to try and settle their priv...
What this means: If a company is caught breaking the law, they can offer a "Voluntary Undertaking" to the Board. This is like a plea deal. They adm...
What this means: This outlines the massive financial penalties companies face for violating the DPDP Act. The Board calculates the fine based on ho...
What this means: Any fine money collected by the Data Protection Board does not go to the victims of the data breach. Instead, the money is deposit...
What this means: The Central Government has the supreme authority to demand any information from any company (Data Fiduciary) or even the Data Prot...
What this means: If a company is a repeat offender (fined more than twice by the Board), the Board can advise the Central Government to completely ...
What this means: This law operates alongside existing laws. However, if there is ever a conflict between what the DPDP Act says and what an older l...
What this means: The Act itself is a broad framework. This section gives the government the legal authority to publish specific, detailed "Rules" (...
