Digital Personal Data
Protection Act (DPDP) 2023
India's comprehensive personal data protection law — establishing rights for data principals, obligations for data fiduciaries, cross-border transfer controls, and a statutory Data Protection Board with penalty powers.
2023
Enacted
Presidential assent Aug 2023
₹250Cr
Max Penalty
Per breach instance
India
Jurisdiction
Extraterritorial for Indian data
DPBI
Regulator
Data Protection Board of India
What is the DPDP Act?
The Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) is India's first comprehensive personal data protection legislation. It establishes a framework of rights for data principals (individuals), obligations for data fiduciaries (organisations processing data), and a statutory Data Protection Board of India to adjudicate complaints and impose penalties.
The Act applies to processing of digital personal data within India, and to processing outside India when it involves personal data of Indian residents — giving it extraterritorial reach similar to GDPR. Organisations operating cloud workloads that touch Indian personal data, regardless of where the processing occurs, may fall within scope.
For sovereign cloud deployments in India, the DPDP Act's cross-border transfer controls (§16) intersect directly with data residency and sovereignty requirements. Sector-specific localisation mandates from RBI, IRDAI, and SEBI continue to apply alongside the DPDP Act's general framework.
Key Obligations
Notice & Consent
DPDP §5–6Data fiduciaries must provide clear notice in English or any scheduled language specified by the data principal before or at the time of collecting personal data.
- Notice must specify data collected, purpose, and grievance mechanism
- Consent must be free, specific, informed, unconditional, and unambiguous
- Separate consent required for each purpose of processing
- Minors require parental consent (under 18 as default)
Rights of Data Principals
DPDP §11–13Data principals (individuals) have rights to access, correct, erase, and nominate. Data fiduciaries must respond within timelines prescribed by the Board.
- Right to access: summary of personal data processed and processing activities
- Right to correction and erasure within prescribed timelines
- Right to nominate a person to exercise rights in event of death or incapacity
- Right to grievance redressal through the fiduciary's grievance mechanism
Obligations of Data Fiduciaries
DPDP §8–10Data fiduciaries bear primary accountability for lawful processing, data quality, security safeguards, and breach notification to the Data Protection Board.
- Process data only for lawful purposes and as per consent given
- Implement technical and organisational security safeguards
- Personal data breach notification to the Board and affected data principals
- Erase personal data when the purpose is fulfilled or consent is withdrawn
- Significant Data Fiduciaries (SDFs) must appoint a Data Auditor and DPO resident in India
Cross-Border Data Transfers
DPDP §16Personal data may be transferred outside India only to countries or territories notified by the Central Government as permissible. Certain categories may be restricted.
- Transfer only to countries on the Central Government's approved list
- Sector-specific localisation requirements may apply (financial, health)
- No personal data transfer to blacklisted countries or entities
- Contracts with overseas recipients must reflect data principal rights
Data Protection Board
DPDP §18–27A statutory Data Protection Board of India adjudicates complaints, investigates breaches, and can impose financial penalties up to ₹250 crore per instance.
- Board adjudicates complaints from data principals and suo motu inquiries
- Penalties up to ₹250 crore (approx. USD 30M) per breach instance
- Appellate Tribunal provides review of Board orders
- Board can direct organisations to cease processing or delete data
Significant Data Fiduciary (SDF) Classification
The Central Government may designate an organisation as an SDF based on one or more of the following criteria. SDFs bear additional obligations including a resident DPO, Data Auditor, and periodic Data Protection Impact Assessments.
- ▲Volume and sensitivity of personal data processed
- ▲Risk to rights of data principals
- ▲Potential national security or public order impact
- ▲Risk to electoral democracy
- ▲Security of the state
- ▲Sovereignty and integrity of India
DPDP Act — Control Mapping
How this platform's sovereignty pillar model maps to DPDP Act obligations for cloud deployments handling Indian personal data.
Data Sovereignty
DPDP §16 – Cross-border transfers- Personal data of Indian residents processed within India or approved jurisdictions
- Sector-specific localisation (RBI payments, IRDAI insurance) takes precedence
- Data flow mapping to identify cross-border transfers and legal basis
- Contractual safeguards with overseas data processors
Operational Sovereignty
DPDP §8 – Security safeguards- Security safeguards proportionate to data sensitivity and volume
- Breach detection and notification to the Data Protection Board
- Data processor agreements with equivalent security obligations
- Significant Data Fiduciaries: resident DPO and Data Auditor mandatory
Technological Sovereignty
DPDP §8(7) – Data erasure- Technical controls to erase data when retention purpose is complete
- Audit trails for consent and withdrawal events
- Portability infrastructure for data principal access requests
- Vendor controls ensuring processing only as per fiduciary instructions
Legal Sovereignty
DPDP §5–6, §16- Lawful purpose basis documented for each processing activity
- No processing under foreign law that overrides DPDP consent requirements
- Sub-processor contracts binding processors to data principal rights
- Transparency obligations — fiduciary identity and grievance contact publicly disclosed
Identity Sovereignty
DPDP §11 – Rights of data principals- Consent Manager mechanism for principals to manage consents in one place
- Identity verification before processing access and correction requests
- Nomination right: data principal controls who can exercise rights posthumously
- Privileged access to personal data systems subject to role-based controls
DPDP Act Timeline
Digital Personal Data Protection Act 2023 receives Presidential assent — enacted into law
MeitY publishes draft DPDP Rules for public consultation (first round)
Further DPDP Rules consultation rounds; Data Protection Board establishment process initiated
Final DPDP Rules expected; Data Protection Board of India to be constituted
Full application following Rules notification; Significant Data Fiduciary classifications published
Disclaimer
Assessments produced by this platform are self-attested evaluations and do not constitute legal advice or formal DPDP Act compliance certification. Organisations processing Indian personal data should seek advice from qualified legal counsel familiar with the DPDP Act, its Rules (when notified), and applicable sector-specific data localisation requirements. The DPDP Rules had not been fully notified as of the platform's build date — requirements may change upon Rules notification.
Ready to assess your DPDP Act posture?
Run a full sovereignty assessment covering DPDP obligations for Indian cloud deployments.