DPDP Act 2023 Explained: A Plain-Language Overview
· Sri Tulasi Tech Labs
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first comprehensive law on the protection of digital personal data. It received Presidential assent in August 2023, and the DPDP Rules, 2025 set out how it works in practice. Together they decide how organisations may collect and use personal data, and what rights individuals have over it.
What does the Act cover?
The Act applies to the processing of digital personal data within India — data collected in digital form, or collected offline and later digitised. It also applies to processing outside India when it is connected with offering goods or services to people in India.
It does not apply to personal data processed by an individual for purely personal or domestic purposes, or to personal data that the person has made publicly available themselves or that is made public under a legal obligation.
The key roles
- Data Principal — the individual the personal data relates to (for a child, this includes the parent or lawful guardian).
- Data Fiduciary — the organisation that decides why and how personal data is processed.
- Data Processor — an organisation that processes data on behalf of a Data Fiduciary, such as a cloud or payroll provider.
- Consent Manager — a registered platform that helps people give, manage and withdraw consent.
- Data Protection Board of India — the body that inquires into breaches of the Act and imposes penalties.
The core obligations in brief
- Process personal data only with valid consent or for a recognised legitimate use.
- Give a clear notice describing the data and the purpose.
- Protect personal data with reasonable security safeguards.
- Notify the Board and affected people of a personal data breach.
- Erase personal data once its purpose is served or consent is withdrawn.
- Take extra care with children’s data.
- Provide a way to handle grievances and requests.
Rights of individuals
Data Principals can ask for information about how their data is processed, request correction, completion, updating or erasure, have grievances addressed, and nominate someone to exercise their rights on their behalf.
When does it apply?
The DPDP Rules, 2025 bring the Act into force in phases. The provisions setting up the Data Protection Board took effect first; the rules on Consent Managers follow after twelve months; and most obligations of Data Fiduciaries apply eighteen months after the Rules were notified. Organisations should use this period to map their data and close gaps.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.