Also known as Digital Personal Data Protection Act, 2023
The DPDP Act requires notice and consent (or another lawful basis) for processing personal data, gives individuals rights to access, correct and erase their data, and places security and breach-reporting duties on data fiduciaries. The DPDP Rules were notified in November 2025, with most duties applying from May 2027.
Example
A broker’s lead list
A Delhi brokerage collects names and phone numbers from a website form. Under the DPDP Act it must show a clear notice of what the data is used for, get consent through an affirmative action such as an unticked box, let the person withdraw as easily as they agreed, and delete the data when it is no longer needed — not keep it forever “just in case”.
Questions about DPDP Act
Who does the DPDP Act apply to?
Any organisation that processes digital personal data in India, or processes it abroad to offer goods or services to people in India. A brokerage, builder or CRM vendor handling buyers’ names and numbers is covered. Personal data a person makes public themselves is largely excluded.
What are the penalties under the DPDP Act?
The Data Protection Board of India can impose penalties set out in the Act’s schedule, up to ₹250 crore for failing to take reasonable security safeguards against a breach. Penalties depend on the nature, gravity and duration of the breach.
What rights do individuals have under the DPDP Act?
The right to information about how their data is processed, to correction and erasure, to grievance redressal and to nominate someone to act for them. Organisations must respond within the time the DPDP Rules set and publish how to make a request.
Sources
See also
Reviewed