DPDP Act 2023 and DPDP Rules 2025 Explained in Plain Language

For most of India's digital era, personal data was governed by a single, ageing instrument: the Information Technology Act, 2000, supplemented by the SPDI Rules of 2011 — a regime designed before smartphones, social platforms, fintech apps and cloud computing made personal data the operating substrate of nearly every business.

The watershed moment was August 2017. A nine-judge constitutional bench of the Supreme Court, in Justice K.S. Puttaswamy (Retd.) v. Union of India, held unanimously that the right to privacy is a fundamental right protected by Article 21. That created a constitutional obligation on the State to enact a comprehensive data protection law.

What followed was a six-year journey. The Justice B.N. Srikrishna Committee delivered a draft Bill in 2018; iterations followed in 2019 and 2022. The current Act — pared down, simplified, and renamed — was introduced in Lok Sabha on 3 August 2023 and received Presidential assent on 11 August 2023. The final DPDP Rules, 2025 were notified by MeitY on 13 November 2025 via Gazette notification G.S.R. 846(E). With that, India finally has an operational data protection regime.

The Act is unusual in two further respects. It is the first Act of the Indian Parliament to use the pronouns "she" and "her" by default, and it follows what MeitY calls the SARAL design — Simple, Accessible, Rational, and Actionable — using plain language throughout the statutory text.

The DPDP Act applies to the processing of digital personal data. That is a deliberately narrow phrase, and each word matters.

Every operative provision of the Act and Rules traces back to seven foundational principles — the bedrock of MeitY's SARAL design. Respect these seven and the rest tends to follow.

These aren't merely aspirational — they map directly onto enforceable obligations: consent in Section 6, purpose limitation in Section 7, security safeguards in Section 8(5), and so on. Treat them as your compliance compass.

The framework introduces a vocabulary of roles you'll meet throughout the Act, the Rules and every operational document. Some borrow from the GDPR; others are uniquely Indian.

Unlike the GDPR with its six lawful bases, the DPDP Act recognises only two grounds: consent, or one of the closed-list legitimate uses in Section 7. There is no broad "legitimate interests" basis to fall back on.

Ground 1: Consent

Consent is the dominant pathway for commercial processing. Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, signified through clear affirmative action — and withdrawable at any time with the same ease it was given. Every request must be accompanied by a Section 5 notice describing the data, purpose, withdrawal and rights mechanics, and route to the DPBI — available in English and each of the 22 Eighth Schedule languages.

Ground 2: Certain Legitimate Uses

Section 7 sets out a closed list of legitimate uses where processing may proceed without consent. The most commonly invoked:

Chapter III confers four substantive rights on every Data Principal, exercisable against any Fiduciary processing her data. The Rules require a response within ninety days of receipt.

The Act also imposes duties on Data Principals — not to file false or frivolous complaints, not to impersonate, not to suppress material information. Breach can attract a penalty of up to ₹10,000 (Section 15).

Section 8, read with the operationalising Rules, sets out the core obligations every Fiduciary must observe — the obligations compliance programmes are built around.

The DPDP Act establishes a purely civil penalty regime — no criminal sanctions. Section 33, read with the Schedule, empowers the DPBI to impose penalties up to specified caps, per contravention.

Orders of the DPBI are appealable to the TDSAT within 60 days, with further appeals to the Supreme Court. Importantly, data processors cannot be directly penalised — the Fiduciary remains liable for processor failures, which makes vendor governance a critical compliance domain.

Although the Act passed in 2023 and the Rules were notified in November 2025, substantive obligations switch on in three phases. Knowing which phase you're in is essential for both legal exposure and programme planning.

The 9-month runway from notification to full enforcement is what makes now the critical preparation window. Organisations that wait until May 2027 will find 9 months barely enough — particularly for data discovery, consent re-engineering, vendor renegotiation and notice translation.

For organisations already aligned to the GDPR or the SPDI Rules, DPDP is partly familiar and partly novel. This comparison surfaces the differences that matter operationally.

For Indian businesses transitioning from the SPDI Rules, the most disruptive shifts are: (a) the move from "sensitive personal data" to uniform treatment, (b) the loss of permissive lawful bases (no more "legitimate interests"), and (c) the dramatic escalation of penalty exposure — from indemnification of actual damages to statutory caps in hundreds of crores.