Digital Personal Data Protection Act, 2023

India had no single, dedicated law on personal data privacy until 2023. Then came a law with fines that can reach ₹250 crore. This lesson covers the Digital Personal Data Protection Act, how it came to be, and how it is being rolled out.

1Chapter 1: India’s First Standalone Privacy Law

Must Know

The timeline

• 11 August 2023: the Act gets Presidential assent. The Lok Sabha passed it on 7 August and the Rajya Sabha on 9 August.
• 13 November 2025: MeitY notifies the DPDP Rules, 2025 and sets up the Data Protection Board of India.
• 13 November 2026: rules on registering and running Consent Managers take effect, one year after notification.
• 13 May 2027: full compliance and enforcement powers, including penalties, begin.

Third time lucky

• In 2017, the government formed a committee under Justice B.N. Srikrishna, a retired Supreme Court judge.
• It sent a report and draft bill in July 2018.
• The draft became the Personal Data Protection Bill, 2019, introduced in the Lok Sabha that December.
• A Joint Parliamentary Committee spent over two years on it, partly delayed by COVID. In December 2021 it proposed 81 amendments.
• Rather than push a heavily amended bill through, the government withdrew it on 3 August 2022. That was a rare move. It promised “a comprehensive legal framework” instead.
• A fresh draft went out for public consultation in November 2022. It was reworked again and became the Act passed in August 2023.
• (Source: The Print.)

A judge’s own warning

• Justice Srikrishna criticised the 2019 bill as tabled.
• In December 2019, he warned it “leads to an Orwellian state where ‘Big Brother’ can snoop into anything that you do.”
• His objection: the tabled bill let government agencies claim broad exemptions on sovereignty or public-order grounds. It stripped out safeguards in his committee’s original draft.
• (Source: The Week.)

Who it governs

• A Data Fiduciary is an organisation that decides how personal data is processed.
• The Act governs how it must treat the data of a Data Principal, the person the data belongs to.
• Maximum penalties can reach ₹250 crore, for failing to put reasonable security safeguards in place.
• The Data Protection Board of India is a fully digital statutory body. It enforces the Act and takes complaints.

2Chapter 2: Children, Consent and Rights

Good to Know

Protecting a child’s data

• Anyone under 18 counts as a “child” under the Act.
• Processing a child’s data needs verifiable parental consent, under Section 9.
• Non-compliance with these provisions can draw penalties up to ₹200 crore.

Consent Managers and rights

• A Consent Manager is a new registered intermediary.
• It lets people give, manage and withdraw consent across different platforms, from one place.
• Data Principals have the right to access, correct and erase their data.
• They can also nominate someone to use these rights after their death or incapacity.

When consent is not needed

• Section 7 lists situations where a Data Fiduciary can process data without asking first. This is called “deemed consent” or “legitimate uses”.
• They include medical emergencies, public health responses and disaster relief.
• They also include state subsidies and services, compliance with a law or court order, and an employer protecting itself from loss.
• This keeps everyday and emergency processing workable, without a fresh consent pop-up every time.
• (Source: DPDP Act, 2023, Section 7.)

3Chapter 3: Narrower by Design

Great to Know

Compared with GDPR

• The EU’s GDPR lists several legal grounds for processing data.
• India’s Act leans mainly on consent and a defined set of “legitimate uses”. It is narrower and simpler by design.
• For sending data abroad, Section 16 flips the usual approach. Data can go to any country by default.
• The government can restrict transfers only to specific countries it names by notification. That is a blocklist, not a whitelist.
• GDPR works the other way. Transfers need an “adequacy” decision approving the destination first.
• As of the source’s writing, India had not notified any restricted country.
• (Source: MediaNama.)
• Read more: The General Data Protection Regulation (GDPR).

The State’s own exemptions

• Government agencies get certain exemptions, for reasons like national security and legal proceedings.
• Critics say this could weaken the law’s protections against the state itself.

Time to prepare

• The long gap between assent (2023) and full enforcement (2027) is deliberate.
• It gives organisations years to build compliance systems before penalties bite.
• A Data Protection Board complaint process now gives people a dedicated forum for data-privacy grievances, separate from ordinary civil courts.
• Read more: UIDAI (Aadhaar).

4Chapter 4: Past Papers and the News

Exam Point of View

UPSC CSP 2024: where the Court put privacy

• UPSC asked under which Article the Supreme Court placed the Right to Privacy.
• The answer is Article 21.
• The 2017 Puttaswamy judgment made privacy a fundamental right. The DPDP Act builds on it.
• (Source: UPSC CSP 2024, Q76.)
• Read more: Right to Privacy and the Puttaswamy Judgment.

UPSC CSP 2019: the global comparison

• UPSC asked which body adopted the GDPR in April 2016, enforced from 25 May 2018.
• The answer is the European Union.
• Know both dates and both frameworks to avoid mixing them up.
• (Source: UPSC CSP 2019, Q88.)

A constitutional challenge

• On 16 February 2026, the Supreme Court issued notice on a challenge to the DPDP Act. It sent the case to a larger five-judge bench.
• It declined to stay the Act meanwhile.
• Two provisions are at the centre: Section 44(3), which amends the RTI Act, and Section 36 with Rule 23, which govern the government’s own power to access personal data.
• (Source: Internet Freedom Foundation.)
• The case, Reporters’ Collective v. Union of India, tests whether a privacy law can weaken a citizen’s separate right to information.
• (Source: MediaNama.)
• Read more: The Right to Information Act, 2005.

A shorter compliance clock

• On 22 January 2026, MeitY proposed cutting the compliance deadline for “Significant Data Fiduciaries” from 18 months to 12.
• These are organisations handling especially large or sensitive volumes of data.
• Likely names at the stakeholder meeting included Meta, Google, Amazon, Microsoft and major banks and financial institutions.
• (Source: Business Standard.)

Quick Q&A

• Assent date? 11 August 2023.
• Max fine? ₹250 crore.
• Child means? Under 18.
• Bill withdrawn? 3 August 2022.
• Full enforcement? 13 May 2027.