What the DPDP Act is, and why India has one
Verified August 2026
The Digital Personal Data Protection Act, 2023 is India's general data protection law. It is Act No. 22 of 2023. It received presidential assent on 11 August 2023. It regulates the processing of digital personal data, gives a Data Principal rights over her own data, and places obligations on a Data Fiduciary.
The Act has nine chapters, forty-four sections and one Schedule. The Schedule is the penalty table. The long title states the purpose: to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes.
Why India needed one
India had no general data protection law. The Information Technology Act, 2000 dealt with some of the ground through section 43A and rules made under it, but it was not a data protection statute and it did not give individuals rights.
That gap became a constitutional problem in 2017. On 24 August 2017 a bench of nine judges of the Supreme Court decided Justice K.S. Puttaswamy (Retd.) v. Union of India. The Court held unanimously that the right to privacy is a fundamental right, protected under Article 21 and as part of the freedoms in Part III of the Constitution. It overruled two earlier decisions that had held otherwise.
A fundamental right needs a statute to give it effect between an individual and a company. The Government constituted an expert committee under Justice B.N. Srikrishna on 31 July 2017, before the judgment was delivered, to study data protection and to draft a bill.
Six years from the judgment to a law
| Date | What happened |
|---|---|
| 31 Jul 2017 | MeitY constituted the expert committee chaired by Justice B.N. Srikrishna. |
| 24 Aug 2017 | Nine judges of the Supreme Court held in Puttaswamy that privacy is a fundamental right. |
| 27 Jul 2018 | The committee reported, with a draft Personal Data Protection Bill, 2018. |
| 11 Dec 2019 | The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha and referred to a Joint Committee the same day. |
| 16 Dec 2021 | The Joint Committee reported. It proposed eighty-one amendments to a bill of ninety-nine sections, and recommended extending the law to non-personal data. |
| 3 Aug 2022 | The Government withdrew the 2019 Bill, saying it would bring a fresh framework instead. |
| 18 Nov 2022 | MeitY released a draft Digital Personal Data Protection Bill, 2022 for public consultation. |
| 3 Aug 2023 | The Digital Personal Data Protection Bill, 2023 was introduced in the Lok Sabha as Bill No. 113 of 2023. |
| 7 Aug 2023 | The Lok Sabha passed the Bill. |
| 9 Aug 2023 | The Rajya Sabha passed the Bill. |
| 11 Aug 2023 | The President assented. The Bill became Act No. 22 of 2023. |
| 13 Nov 2025 | The Government notified the DPDP Rules, 2025 and, by a separate notification, brought part of the Act into force. |
Why the law matters now and did not before
The Act did not come into force when it was passed. Section 1(2) says the Act comes into force on such date as the Central Government appoints by notification, and that different dates may be appointed for different provisions. The Government appointed no date for more than two years. Between August 2023 and November 2025 the Act was law that bound nobody.
That changed on 13 November 2025. The Government issued two notifications on the same day. One brought the first group of sections into force. The other made the DPDP Rules, 2025 under section 40. Together they set the two dates that now apply to every Data Fiduciary. See the deadlines.
How the Act and the Rules fit together
The Act sets the principles and the duties. It leaves the detail to rules, using the phrase as may be prescribed throughout. Section 40 gives the Central Government the power to make those rules. Section 41 requires them to be laid before Parliament.
The DPDP Rules, 2025 are that detail. They set what a notice must look like, what reasonable security safeguards mean, how a breach is intimated, when data must be erased, what a Consent Manager must satisfy, and what a Significant Data Fiduciary must do. Neither document works without the other, and both commence in stages.
The nine chapters
| Chapter | What it covers | Sections |
|---|---|---|
| I | Preliminary. Short title, commencement, definitions and application. | 1–3 |
| II | Obligations of a Data Fiduciary. Notice, consent, legitimate uses, general duties, children, and Significant Data Fiduciaries. | 4–10 |
| III | Rights and duties of a Data Principal. | 11–15 |
| IV | Special provisions. Transfer of personal data outside India, and exemptions. | 16–17 |
| V | The Data Protection Board of India. | 18–26 |
| VI | Powers, functions and procedure of the Board. | 27–28 |
| VII | Appeal and alternate dispute resolution. | 29–32 |
| VIII | Penalties and adjudication. | 33–34 |
| IX | Miscellaneous, including the rule-making power and the amendments to three other Acts. | 35–44 |
Three other laws the Act changes
Section 44 amends three statutes. Section 44(1) amends the Telecom Regulatory Authority of India Act, 1997. The Telecom Disputes Settlement and Appellate Tribunal now hears appeals under this Act. The right of appeal itself starts on 13 May 2027 — see the courts. Section 44(2) amends the Information Technology Act, 2000, and omits section 43A of that Act. Section 44(3) substitutes section 8(1)(j) of the Right to Information Act, 2005.
Two of these are already in force and one is not. Section 44(1) and section 44(3) came into force in November 2025. Section 44(2) sits in the group that starts in May 2027, which means section 43A of the Information Technology Act has not been omitted and is still law. Published commentary often states this incorrectly.
The change to the Right to Information Act is under challenge in the Supreme Court. The Supreme Court referred the challenges to the Act and the Rules to a larger bench on 16 February 2026. It refused an interim stay on the same date. It has not announced the size of the larger bench. Section 44(3) is the most prominent ground in that case.
A judgment of the larger bench on section 44(3). An amendment to the Act. A notification bringing the remaining provisions into force earlier or later than the dates now set.
Sources. The Act as published by India Code and by MeitY. Committee and bill dates from PRS Legislative Research and the Press Information Bureau. See the sources page.