The DPDP Act in 10 minutes: what every Indian business needs to know

If your business collects a customer’s phone number, an employee’s PAN or a website visitor’s email address, India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) applies to you. It’s short, at 44 sections, but it changes how almost every organisation in India handles information about people.

Here’s the whole law in ten minutes.

What it protects

The Act protects digital personal data: any data about an individual who can be identified from it. That includes data collected online, and data collected on paper that you later digitise. A customer register you type into Excel counts. A paper visitor book that never leaves the reception desk does not.

The three roles

• Data Principal: the person the data is about. For a child, it includes the parent; for a person with a disability who has a lawful guardian, it includes the guardian.
• Data Fiduciary: the organisation that decides why and how the data is processed. That’s usually you.
• Data Processor: a vendor that processes data on your behalf, such as a payroll provider, a cloud host or a call centre.

The core rule: a reason for every use

You may process personal data only for a lawful purpose, and only on one of two grounds:

1. Consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, or
2. A legitimate use listed in section 7, such as employment purposes, a medical emergency, or complying with a court order.

Consent must come with a notice in clear language that says what data you collect and why, how to withdraw consent, how to complain, and how to complain to the Data Protection Board.

Your duties as a Data Fiduciary

• Protect data with reasonable security safeguards.
• Report every personal data breach to the affected people and to the Data Protection Board.
• Keep data accurate when you use it to make decisions about people.
• Erase data when the purpose is over or consent is withdrawn, unless a law requires you to keep it.
• Have a working grievance process and publish who people can contact.
• Use processors only under a contract.

The rights people get

People can ask for a summary of their data, correct or erase it, nominate someone to act for them, and complain to you and then to the Board. They also have duties: no false complaints and no impersonation, with a penalty of up to ₹10,000.

Children

Anyone under 18 is a child. You need verifiable parental consent, and you may not track, behaviourally monitor or target advertising at children.

When it applies

The DPDP Rules, 2025 were notified on 13 November 2025 and bring the law in over 18 months:

Penalties

There is no jail term. Instead the Board can impose penalties of up to ₹250 crore per breach for failing to protect data, ₹200 crore for failing to report a breach or for breaking the rules on children’s data, and up to ₹50 crore for other breaches.

What to do this month

Make a list of the personal data you hold and why. That one exercise tells you where consent is needed, which vendors need contracts, and what you can delete today.

Go deeper

Our online courses take you through every section of the Act and the Rules with practical exercises. Browse the courses.

This article is for education and is not legal advice.