We get the same questions from compliance heads, CIOs and CFOs across sectors. Here's a plain-language primer and answers to the questions you're probably about to ask.
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to any organisation that processes the personal data of individuals in India — regardless of where the organisation is based.
Individuals — called Data Principals — own their personal data. Organisations — called Data Fiduciaries — can process that data only for clearly stated, lawful purposes, and only with the principal's consent or under specific legitimate uses defined in the Act.
The Data Protection Board of India enforces the Act and can impose penalties of up to ₹250 crore per instance for serious breaches.
Almost every organisation operating digitally in India. The Act exempts certain government processing and very limited research activities, but the working assumption for any commercial enterprise should be: you are in scope.
About what's processed, why, and how.
To their own personal data on request.
To fix or delete inaccurate data.
For incapacity or in case of death.
Via a clearly published channel.
As easily as it was given.
Where applicable, in standard formats.
The DPDPA places concrete duties on every Data Fiduciary. These are the obligations any meaningful compliance programme has to address.
Process personal data only with consent, or under the specifically defined "legitimate uses" in the Act.
Give Data Principals a clear, itemised notice of what data is collected, why, and how — before collection.
Use personal data only for the purpose disclosed. Want to use it differently? You need fresh consent.
Collect only what's necessary for the stated purpose. Delete when no longer needed or consent is withdrawn.
Implement reasonable technical and organisational measures — encryption, access controls, audit logs.
Report breaches to the Data Protection Board and affected individuals within prescribed timelines.
Short, direct answers below. For longer, sector-specific responses, get in touch.