DIGITAL PERSONAL DATA PROTECTION ACT, 2023

Read the verified legal text, understand each provision in plain language, and move directly from law to implementation.

Statutory Status & Legislative Authority
Act No. 22 of 2023 enacted by the Parliament of India • Assented to by the President on August 11, 2023 (Gazette of India Extraordinary, Part II—Section 1, No. 40). Under Section 1(2), provisions come into force on dates appointed by Central Government notification. This reader reflects verbatim Gazette text.
Status Enacted
Total Sections 32 Sections
Last Verified Recently
Official Source The Gazette of India
READ FROM SECTION 1

Chapter I — Preliminary

3 Sections
Section 1
Short title and commencement

What this means: This section simply gives the law its official name: The Digital Personal Data Protection Act, 2023. It also states that the gover...
Section 2
Definitions

What this means: This section defines all the important legal terms used in the Act. Important Definitions:- Data Principal: You (the person the da...
Section 3
Application of Act

Who this applies to: This defines the scope of the DPDP Act. Key Takeaways:1. It applies to digital data collected in India (or physical data that ...

Chapter II — Obligations of Data Fiduciary

7 Sections
Section 4
Grounds for processing personal data

What this means: A company can only process your data if they have a legal reason to do so. This legal reason must be either:1. You gave them your ...
Section 5
Notice

What this means: Before a company asks for your consent, they must give you a clear "Notice".The Notice Must Tell You:- Exactly what data they want...
Section 6
Consent

What this means: Consent must be real. It cannot be forced or hidden in complex terms and conditions. A company can only ask for data that is stric...
Section 7
Certain legitimate uses

What this means: In specific situations, companies or the government do not need to ask for your explicit consent to process your data. This is cal...
Section 8
General obligations of Data Fiduciary

What this means: This is the most critical section for companies, establishing their core responsibilities.Company Obligations:- They must use a le...
Section 9
Processing of personal data of children

What this means: The law provides strict safeguards for children (under 18).Key Rules:- Companies must obtain "verifiable consent" from parents bef...
Section 10
Additional obligations of Significant Data Fiduciary

What this means: Large technology companies (like major social media networks or banks) that process huge volumes of data or pose a risk to the nat...

Chapter III — Rights and Duties of Data Principal

5 Sections
Section 11
Right to access information about personal data

Your Rights: You have the right to ask any company what data they hold on you. You can demand:1. A summary of the data they are processing.2. A lis...
Section 12
Right to correction and erasure of personal data

Your Rights (Right to be Forgotten): You have the right to control the accuracy and existence of your data.You can ask a company to:- Fix any wrong...
Section 13
Right of grievance redressal

Your Rights: If a company misuses your data, you have the right to complain.Companies must provide an easy-to-use grievance mechanism. However, you...
Section 14
Right to nominate

Your Rights: You can nominate someone (like a family member) to manage, access, or delete your digital personal data in the event of your death or ...
Section 15
Duties of Data Principal

Your Duties: While the law gives you rights, it also requires you to act responsibly.You must:- Not use fake identities or impersonate others.- Not...

Chapter IV — Special Provisions

2 Sections
Section 16
Processing of personal data outside India

What this means: The Indian government has the power to create a "blacklist" of countries. Companies are not allowed to transfer Indian citizens' d...
Section 17
Exemptions

What this means: This section lists the situations where the strict rules of the DPDP Act do not apply.Major Exemptions:- Courts, law enforcement, ...

Chapter V — Data Protection Board of India

4 Sections
Section 18
Establishment of Board

What this means: This creates a new national regulatory body: The Data Protection Board of India. This Board is responsible for enforcing the Act, ...
Section 19
Composition and qualifications for appointment of Chairperson and Members

What this means: The Board will be led by a Chairperson and several Members appointed by the Central Government. They must be experts in fields lik...
Section 20
Salary, allowances payable to and term of office

What this means: Board members serve for a term of 2 years and can be re-appointed. Their salaries cannot be maliciously reduced to force them out ...
Section 26
Powers of Chairperson

What this means: The Chairperson is the ultimate administrative head of the Data Protection Board and decides which members or groups handle specif...

Chapter VI — Powers, Functions and Procedure to be Followed by Board

2 Sections
Section 27
Powers and functions of Board

What this means: The Board has the power to:- Force a company to take urgent action to stop an ongoing data breach.- Investigate complaints from ci...
Section 28
Procedure to be followed by Board

What this means: The Board operates primarily as a "digital office", meaning hearings and complaints are handled online to maximize speed and effic...

Chapter VII — Appeal and Alternate Dispute Resolution

3 Sections
Section 29
Appeal to Appellate Tribunal

What this means: If a company (or a citizen) is unhappy with a penalty or decision handed down by the Data Protection Board, they have 60 days to f...
Section 31
Alternate dispute resolution

What this means: Instead of going through a long, formal legal proceeding, the Board can force a company and a citizen to try and settle their priv...
Section 32
Voluntary undertaking

What this means: If a company is caught breaking the law, they can offer a "Voluntary Undertaking" to the Board. This is like a plea deal. They adm...

Chapter VIII — Penalties and Adjudication

2 Sections
Section 33
Penalties

What this means: This outlines the massive financial penalties companies face for violating the DPDP Act. The Board calculates the fine based on ho...
Section 34
Crediting sums realised by way of penalties

What this means: Any fine money collected by the Data Protection Board does not go to the victims of the data breach. Instead, the money is deposit...

Chapter IX — Miscellaneous

4 Sections
Section 36
Power to call for information

What this means: The Central Government has the supreme authority to demand any information from any company (Data Fiduciary) or even the Data Prot...
Section 37
Power of Central Government to issue directions

What this means: If a company is a repeat offender (fined more than twice by the Board), the Board can advise the Central Government to completely ...
Section 38
Consistency with other laws

What this means: This law operates alongside existing laws. However, if there is ever a conflict between what the DPDP Act says and what an older l...
Section 40
Power to make rules

What this means: The Act itself is a broad framework. This section gives the government the legal authority to publish specific, detailed "Rules" (...