Understanding the DPDP Act, 2023

Knowledge Resources › Understanding the DPDP Act, 2023

Last updated: 6 August 2026

The Digital Personal Data Protection Act, 2023 is India's first comprehensive law dedicated to the protection of personal data. It applies to the processing of digital personal data within India, and in certain cases to processing outside India where it is connected with offering goods or services to individuals in India.

At its core, the Act is built on the principle of consent. Organisations (referred to as “Data Fiduciaries”) must generally obtain clear, informed consent before processing personal data, and must tell individuals what data is being collected and why.

Key obligations

• Notice and consent — informing individuals and obtaining consent before processing
• Purpose limitation — using data only for the stated purpose
• Data security — maintaining reasonable safeguards against breaches
• Breach notification — reporting personal data breaches to the Data Protection Board and affected individuals
• Rights of individuals — enabling access, correction, and erasure of personal data

Some organisations — for example, those notified by the Government as Significant Data Fiduciaries — face additional obligations, such as appointing a Data Protection Officer and conducting Data Protection Impact Assessments. Understanding where an organisation falls within the Act is the first step toward compliance. The Act's provisions are being brought into force in phases.