DPDP Act 2023 Full Text: Sections, Rules and Schedules

Defines the core vocabulary — personal data (2(t)), Data Principal (2(j)), Data Fiduciary (2(i)), Data Processor (2(k)), consent, and processing. All personal data is treated uniformly; there is no separate "sensitive" category.

Applies to digital personal data within India and to processing outside India connected to offering goods/services to people in India. Excludes personal/domestic use and data made publicly available by the Principal or under legal obligation.

Consent must be free, specific, informed, unconditional and unambiguous, by clear affirmative action — and withdrawable as easily as it was given. Introduces the Consent Manager ecosystem.

A closed list of uses where processing may proceed without consent: voluntary provision, State functions, legal compliance, medical emergencies, disasters, and employment. No broad "legitimate interests" basis exists.

Accuracy, reasonable security safeguards, breach notification, storage limitation and erasure, and a grievance mechanism. Section 8(2) makes the Fiduciary liable for its processors.

Verifiable parental consent before processing data of anyone under 18; absolute prohibition on tracking, behavioural monitoring and targeted advertising of children.

The Government may designate SDFs by volume, sensitivity, risk and sovereignty factors. SDFs must appoint an India-resident DPO, run annual DPIAs and independent audits.

A summary of personal data being processed, the processing activities, and the identities of other Fiduciaries with whom it has been shared.

Correction of inaccurate or misleading data, completion of incomplete data, and erasure of data no longer needed for the stated purpose.

Approach the Fiduciary's grievance officer first; escalate to the DPBI only after exhausting that mechanism. 90-day response SLA.

Appoint another individual to exercise these rights on your behalf in the event of death or incapacity.

No false or frivolous complaints, no impersonation, no suppression of material information. Breach can attract a penalty of up to ₹10,000.

Default-permitted: the Government may restrict transfer to specified countries by notification. As of May 2026, no country has been blacklisted.

Conditional, notified exemptions for certain State and research processing — not a blanket carve-out; safeguards still apply.

A digital-first adjudicatory body that inquires into breaches, directs remedial measures and imposes penalties. Constitution, composition and procedure run through Rules 16-22.

Appeals from DPBI orders lie to the Telecom Disputes Settlement and Appellate Tribunal within 60 days; further appeal to the Supreme Court on questions of law.

Civil-only penalties, per contravention: ₹250 Cr (security), ₹200 Cr (breach notice / children), ₹150 Cr (SDF), ₹50 Cr (any other), ₹10K (Data Principal duties). The Board weighs nature, gravity, duration, repetition, gains and remediation.

Prescribes the itemised content and form of the notice required under Section 5.

How Consent Managers register with the DPBI and the standards they must meet. Expected to commence in Phase 2 (~Nov 2026).

The seven safeguard categories: encryption, access control, backups, 1-year log retention, detection, processor contracts and technical/organisational measures.

Two-track intimation — to the Board "without delay" with prescribed contents, and to affected Data Principals as soon as feasible.

Retention defaults for high-volume e-commerce, gaming and social-media entities: three years from last activity, with 48-hour pre-erasure intimation.

Requires identity-verified parental consent before processing children's data; self-declared age gates do not suffice.

DPIA, annual independent audit, India-resident DPO reporting to the Board, and periodic risk assessment.

Operationalises the rights process and the 90-day response SLA.

Maps each contravention to its monetary ceiling under Section 33.

User-count thresholds that trigger the Rule 8 retention defaults for e-commerce, gaming and social-media intermediaries.