What India Digital Personal Data Protection Act 2023 (DPDP Act, Act No. 22 of 2023) requires
The Digital Personal Data Protection Act 2023 (DPDP Act, Act No. 22 of 2023) is India's first comprehensive data protection legislation, receiving Presidential assent on 11 August 2023 and administered by the Data Protection Board of India (DPBI) to be constituted under Section 18. The DPDP Act establishes rights for data principals (individuals whose data is processed) and obligations for data fiduciaries (entities that determine the purpose and means of processing personal data). Section 4 provides that personal data may only be processed for a lawful purpose with the consent of the data principal. Section 7 identifies circumstances where processing does not require consent, including performance of a function of the State, compliance with legal obligations, medical emergencies, and employment purposes. Section 8 imposes obligations on data fiduciaries: they must process data only for the specified and lawful purpose; ensure accuracy and completeness of data; implement appropriate technical and organisational security measures; notify the DPBI of personal data breaches; and erase personal data where it is no longer necessary. Section 9 requires data fiduciaries processing children's data (under 18 years) to obtain verifiable parental consent. Section 13 provides data principals with the right of access to information about their personal data, the right to correction and erasure, the right to grievance redressal, and the right to nominate another person to exercise rights on their behalf in the event of death or incapacity. The DPDP Act imposes financial penalties of up to INR 250 crore (approximately USD 30 million) for personal data breaches, up to INR 200 crore for failure to notify breaches, and up to INR 50 crore for violations of children's data provisions. The DPDP Rules 2025 were notified in February 2025 for public consultation.
Pillar: Data Protection & Privacy · Authority: Ministry of Electronics and Information Technology (MeitY); Data Protection Board of India · Version: 1.0.1 · Last updated:
Primary source: https://www.meity.gov.in/data-protection-framework
SHA-256 integrity: 92af6e51d33758fb2badf06763696e6bdafa9980a1f266ed229d60c263b82e0c
Primary Citations — 7 traced to source
- Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) (India), Section 4 - Grounds for processing: personal data may only be processed for a lawful purpose with the consent of the data principal or for certain legitimate uses
- Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) (India), Section 5 - Notice: data fiduciary must provide a clear and plain notice to data principals describing the personal data to be collected and the purpose of processing
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/in-dpdp-act-2023.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/in-dpdp-act-2023.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/in-dpdp-act-2023
- Back to registry: Browse all 10,085 compliance nodes