DPDP Act (India)
Also known as: DPDP Act, DPDPA, Digital Personal Data Protection Act, India data protection law, DPDP Rules
India's Digital Personal Data Protection (DPDP) Act is the country's first comprehensive data protection law, covering personal data in digital form and built around consent and the duties of 'data fiduciaries.' While it arrived later than most major economies' laws, its reach is enormous, covering a digital population of hundreds of millions.
It's also deliberately simpler than GDPR, with fewer legal bases and broad government exemptions.
DPDP Act (India), explained at three levels
At home
Think of the DPDP Act as a trust arrangement. When you hand an Indian company your personal data online, the company becomes a 'data fiduciary,' holding it in trust for a stated purpose. It must ask for your consent clearly, use the data only for that purpose, protect it, and delete it when done. You can withdraw consent as easily as you gave it.
At work
The DPDP Act is India's first comprehensive data protection law. It covers digital personal data processed in India, and data processed abroad when it relates to offering goods or services to people in India. Businesses act as data fiduciaries and must give clear notices, get valid consent or rely on a listed legitimate use, secure data, report breaches, and erase data when it is no longer needed.
At home
The Act names three roles. You are the 'data principal,' the company is the 'data fiduciary,' and a 'consent manager' is a registered middleman that lets you give and withdraw consent across services. Your rights include a summary of your data and who received it, correction and erasure, and grievance redress. You can also nominate someone to use your rights if you die or become unable to act. For children, companies need verifiable parental consent.
At work
Obligations come in tiers. Every data fiduciary must give itemized consent notices, available in English or any of the 22 languages in the Constitution's Eighth Schedule, implement reasonable security safeguards, report breaches to the Data Protection Board and affected people, and erase data once its purpose ends. Processors act under contract. Fiduciaries the government designates as 'significant,' based on data volume and risk, must also appoint an India-based data protection officer, run periodic impact assessments, and undergo independent audits.
At home
Consent managers are the Act's most unusual piece. They are companies registered with the Data Protection Board that act as a single dashboard for your consents, recording what you agreed to and letting you withdraw it across many services. They must work with each other and must not be able to read the personal data itself. In my view, it's a genuinely innovative idea that could make consent meaningful, but only if consent managers stay trustworthy and enough companies plug into them.
At work
Unlike GDPR, the DPDP Act relies on consent plus a short list of 'legitimate uses,' such as employment and legal obligations, rather than a broad legitimate interests basis. It applies only to digital data, or data later digitized, and the government can exempt its own agencies for reasons such as national security. Transfers abroad are allowed unless the government restricts a country. The Rules phase most obligations in by mid-2027, and sector regulators such as the Reserve Bank of India can impose stricter localization.
Real-world examples
At home
Aisha's cousin in Bengaluru signed up for a food delivery app that showed a short consent notice in Kannada, explaining what data it collected and why. Later, she withdrew consent for marketing messages through the app's settings, just as easily as she'd given it.
At work
Marcus manages product compliance at a Canadian fintech serving Indian customers. His team mapped which data they processed under consent versus legitimate uses, translated consent notices, and set up a breach response plan to meet the DPDP Rules' notification requirements before the main obligations took effect.
How it compares
| feature | DPDP Act (India) | GDPR |
|---|---|---|
| Data covered | Digital personal data only | All personal data, digital or not |
| Main legal basis | Consent plus limited legitimate uses | Six bases including legitimate interests |
| Cross-border transfers | Allowed unless the government restricts a country | Restricted unless a transfer mechanism applies |
| Maximum penalty | Up to ₹250 crore per breach | 4% of global turnover |
| Government exemptions | Broad | Narrower, subject to EU law |
The DPDP Act is simpler than GDPR, with a stronger reliance on consent and broader state exemptions.
For analysts
With obligations phased in through 2027, India is a market where early preparation pays off. I'd prioritize consent notices and deletion processes now, since those touch every product and take the longest to change.
History & origin
The push for an Indian privacy law gained force after the Supreme Court's 2017 Puttaswamy judgment recognized privacy as a fundamental right. Several drafts followed, including a 2019 bill that was withdrawn in 2022. The DPDP Act was passed and received assent on August 11, 2023. The government notified the implementing DPDP Rules in November 2025, establishing the Data Protection Board immediately and phasing in most obligations over roughly 18 months, with consent manager provisions earlier. Penalties can reach ₹250 crore for some breaches. In my opinion, India's slow path to a law, and its broad state exemptions, show how hard it is to balance individual privacy with an ambitious digital government agenda.