The Digital Personal Data
Protection Act, 2023

Foundational interpretative framework establishing statutory nomenclature.

Territorial and material scope with extraterritorial reach provisions.

Binary lawful basis: Consent or Legitimate Uses under Section 7.

Mandatory pre-consent notice in prescribed form and vernacular languages.

Architecture for valid consent with withdrawal mechanics.

Exhaustive enumeration of non-consent processing grounds.

Core fiduciary duties spanning accuracy, security, retention, and breach notification.

Enhanced protections with verifiable parental consent requirement.

Entitlement to summary of personal data and processing activities.

Correction of inaccurate/incomplete data and erasure rights.

Tiered redressal mechanism with prescribed timelines.

Succession planning for data rights through nomination.

Reciprocal obligations on data subjects—a novel feature.

Enhanced regime for high-risk data processors with DPIA and audit requirements.

Negative list approach to cross-border data flows.

Broad State and security exemptions with proportionality safeguards.

The Central Government establishes the Data Protection Board of India by notification, as a body corporate.

A Chairperson and such number of other Members as the Central Government may notify, appointed in the manner prescribed.

Terms of service are prescribed by Rules; the Chairperson and Members hold office for two years and are eligible for re-appointment.

Grounds on which a person is disqualified from appointment or continuation as Chairperson or Member.

Resignation by notice in writing to the Central Government, and filling of vacancies by fresh appointment.

The Board observes the prescribed procedure for meetings and conduct of business, including by digital means.

The Board may appoint officers and employees, with the previous approval of the Central Government, on prescribed terms.

The Chairperson, Members, officers and employees are deemed public servants when acting under the Act.

General superintendence and direction of the Board, including assignment of proceedings.

On a breach intimation, complaint or reference, the Board may direct urgent remedial or mitigation measures, inquire, and impose penalties.

The Board functions as an independent, digital-by-design body, inquires in line with natural justice, and has certain powers of a civil court.

Appeal from an order or direction of the Board lies to the Appellate Tribunal (TDSAT) within sixty days.

Orders of the Appellate Tribunal are executable as a decree of a civil court.

The Board may direct the parties to attempt resolution of a complaint through mediation.

The Board may accept a voluntary undertaking at any stage of proceedings under Section 28.

Monetary penalties specified in the Schedule, imposed by the Board after inquiry where a breach is significant.

The Central Government may require the Board, any Data Fiduciary or any intermediary to furnish information for the purposes of the Act.

On a reference from the Board, the Central Government may direct blocking of public access to a Data Fiduciary that has been penalised in two or more instances.

The Act is in addition to other laws; in case of conflict, the Act prevails to the extent of the conflict.

No civil court has jurisdiction over matters the Board is empowered to determine, and no injunction may be granted.

The Central Government may make rules to carry out the Act. The DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) were made under this power.

The Central Government may amend the Schedule, but not so as to increase any penalty beyond twice the amount originally enacted.

The Central Government may make orders to remove difficulties, not later than three years from commencement.

Consequential amendments to the TRAI Act, 1997, the Information Technology Act, 2000 (omitting Section 43A and Section 87(2)(ob)) and the RTI Act, 2005 (Section 8(1)(j)).

Supplementary definitions extending Section 2 of the Act.

Detailed requirements for Section 5 notices including language and format.

Registration process and obligations for Consent Managers under Section 2(g).

Processing of personal data by State for subsidies, benefits, services.

Technical and organisational security measures under Section 8(5).

Intimation of personal data breach under Section 8(6).

Time period for specified purpose to be deemed no longer served.

Contact information of person to answer questions about processing.

Verifiable consent for processing personal data of child under Section 9.

Additional obligations for Significant Data Fiduciaries under Section 10.

Mechanisms for Data Principals to exercise rights under Sections 11-14.

Requirements for transfer of personal data outside India.