What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's law on how digital personal data may be processed. It received Presidential assent on 11 August 2023. The DPDP Rules, 2025 add the details.
Is the DPDP Act in force?
Partly. Under notification G.S.R. 843(E) dated 13 November 2025, the definitions and the provisions on the Data Protection Board came into force on 13 November 2025. Consent Manager registration starts on 13 November 2026. Most obligations on Data Fiduciaries, and the rights of Data Principals, start on 13 May 2027. See the deadlines page.
Who has to comply?
Any person who decides the purpose and means of processing digital personal data (a Data Fiduciary), in India, or outside India when processing is connected to offering goods or services to people in India. See section 3.
Does the Act apply to data I post publicly?
No. The Act does not apply to personal data that the person herself makes publicly available, or that someone is legally required to make public. See section 3.
What is a Data Principal?
The individual to whom the personal data relates. For a child, it includes the parents or lawful guardian. See section 2.
What is a Consent Manager?
A person registered with the Board who acts as a single point of contact to help a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. See section 2, section 6 and rule 4.
Who is a child under the Act?
An individual who has not completed eighteen years of age. See section 2.
How quickly must a company report a breach?
From 13 May 2027, a Data Fiduciary must inform each affected Data Principal and the Board without delay, and send the Board a detailed report within seventy-two hours, unless the Board allows more time. See rule 7.
What are the maximum penalties?
Up to two hundred and fifty crore rupees for failing to take reasonable security safeguards, as listed in the Schedule to the Act. See the penalties guide.
Can I get compensation under the Act?
The Act provides for penalties imposed by the Board, which go to the Consolidated Fund of India. It does not provide for compensation to individuals. See section 34.
How do I complain?
First use the grievance redressal system of the Data Fiduciary or Consent Manager. Only after that can you approach the Board. See section 13. The Board's complaint functions start on 13 May 2027.
How long does a company have to answer my grievance?
A reasonable period not exceeding ninety days, under rule 14(3). See rule 14.
Can my data be sent abroad?
Yes, unless the Government restricts transfer to a country by notification, subject to requirements under rule 15 and any stricter sector law. See section 16.
Has the Data Protection Board been appointed?
The Board was established by G.S.R. 844(E) dated 13 November 2025. As of the latest official sources we found, the Chairperson and Members had not been appointed. See the Board page.
Is this website official?
No. dpdpr.in is an independent reference. It is not affiliated with the Government of India, MeitY or the Data Protection Board. It is not legal advice.