The DPDP Act governs how personal data is collected, used, shared and protected. It gives individuals rights over their data and places responsibilities on those processing it.
This overview covers the Act only. Requirements under the Rules are explained separately. Different provisions have different commencement dates, so check when a requirement takes effect.
Applicability & exemptions
The Act covers personal data collected digitally or collected on paper and later digitised. It applies to processing within India and processing outside India connected with offering goods or services to individuals within India.
Personal or domestic processing by individuals is excluded. So is data made publicly available by the individual concerned or by someone legally required to publish it.
Section 17 provides exemptions for specified situations, including legal claims, investigations and certain research. The extent of each exemption differs. Accountability and security obligations continue to apply to processing covered by Section 17(1).
Relevant provisions: Sections 3 and 17.
Data Fiduciary & Data Processor
A Data Fiduciary decides why and how personal data is processed. A Data Processor processes it on the Fiduciary’s behalf. Your organisation may be a Fiduciary for its customer data and a Processor for data handled for a client.
The Fiduciary remains responsible for processing carried out on its behalf. A vendor contract cannot transfer that statutory responsibility.
The Act requires appropriate technical and organisational measures, an effective grievance mechanism and published contact information for questions about processing. Data used to make decisions affecting individuals, or shared with another Fiduciary, must be complete, accurate and consistent.
Relevant provisions: Sections 2 and 8.
Data Principal
The Data Principal is the individual the personal data relates to. The Act provides rights to access information about processing, seek correction and erasure, raise grievances and nominate someone to exercise rights in the event of death or incapacity.
Access and correction rights cover data processed on consent, including voluntary provision under Section 7(a), subject to the Act’s conditions. Individuals must first use the internal grievance mechanism before approaching the Board.
They also have duties, including avoiding impersonation and false or frivolous complaints, and providing verifiably authentic information when seeking correction or erasure.
Relevant provisions: Sections 2 and 11–15.
Notice & consent
Before or when asking for consent, explain what personal data you propose to process, why you need it, and how the individual can withdraw consent, raise a grievance and complain to the Board.
Consent must be freely given, specific, informed, unconditional and unambiguous, with a clear affirmative action. It covers only the data necessary for the stated purpose. Withdrawing consent must be comparably easy to giving it.
Individuals can also manage consent through a registered Consent Manager. If consent is questioned in proceedings, the Fiduciary must prove that valid notice was given and valid consent obtained.
Relevant provisions: Sections 5 and 6.
Certain legitimate uses
Consent is one ground for processing. Section 7 permits specified uses without it.
These include data voluntarily provided for a specified purpose where the individual has not indicated refusal, certain government functions and benefits, legally required disclosures to the State, compliance with specified court orders, medical emergencies, public health measures, disaster response and employment purposes. Each use has its own conditions.
For example, giving a pharmacy your number to receive a payment receipt permits its use for that purpose. It does not automatically authorise unrelated marketing.
Relevant provisions: Sections 4 and 7.
Children’s data
Under the Act, a child is anyone under 18. Processing a child’s personal data generally requires verifiable parental or lawful guardian consent.
Processing likely to harm a child’s well-being is prohibited, as are tracking, behavioural monitoring and targeted advertising directed at children. The Act allows specified exemptions from parental consent and tracking or advertising restrictions, subject to prescribed conditions or government notification.
Parental consent does not override the prohibition on harmful processing. Section 9 also requires verifiable guardian consent for processing data of a person with disability who has a lawful guardian.
Relevant provisions: Sections 2 and 9.
Security & data breaches
Data Fiduciaries must take reasonable security safeguards to prevent personal data breaches, including where a Processor handles the data.
A breach can involve unauthorised processing, accidental disclosure, alteration, destruction or loss of access that compromises confidentiality, integrity or availability. Sending customer records to the wrong recipient can therefore be a breach.
When a personal data breach occurs, the Act requires notification to the Data Protection Board and each affected Data Principal. The Act leaves the notification procedure to the Rules and does not itself specify an hourly reporting deadline.
Relevant provisions: Sections 2(u), 8(4), 8(5) and 8(6).
Retention & erasure
Personal data should be erased when consent is withdrawn or when it is reasonable to assume the specified purpose is no longer served, whichever happens earlier, unless retention is necessary to comply with law. The Fiduciary must also cause its Processor to erase data supplied for processing.
Withdrawal generally requires processing to stop within a reasonable time, subject to legally permitted continued processing. An erasure request under Section 12 has its own exception where retention remains necessary for the specified purpose or legal compliance.
Organisations need to know which records can be deleted and which must be retained.
Relevant provisions: Sections 6(6), 8(7)–(8) and 12.
Significant Data Fiduciaries
The Central Government can designate a Data Fiduciary or a class of Fiduciaries as Significant Data Fiduciaries. Relevant factors include the volume and sensitivity of data, risks to individual rights, national security and public order.
Designation brings additional responsibilities: an India-based Data Protection Officer responsible to the Board of Directors or equivalent governing body, an independent data auditor, periodic Data Protection Impact Assessments and periodic audits. The Act requires periodic assessments and audits but leaves further detail to the Rules.
An organisation does not become an SDF merely because it considers itself large or handles sensitive information.
Relevant provisions: Section 10.
Cross-border transfers
The Act allows the Central Government to restrict transfers of personal data to notified countries or territories. It does not impose a general requirement to keep all personal data in India.
Other Indian laws offering greater protection or imposing stricter overseas transfer restrictions continue to apply. Before transferring data abroad, an organisation therefore needs to consider both restrictions under the DPDP Act and any other applicable legal requirements.
Using an overseas service provider also leaves the Fiduciary responsible for processing carried out on its behalf.
Relevant provisions: Sections 8 and 16.
Data Protection Board
The Act provides for a Data Protection Board of India with a Chairperson and members appointed by the Central Government. Its functions include examining specified complaints and breach intimations, conducting inquiries, directing urgent measures following a breach and imposing monetary penalties.
It must follow principles of natural justice and give affected persons an opportunity to be heard. During inquiries, it has specified civil-court powers, including summoning people and requiring documents.
The Act envisages digital proceedings. A complaint does not automatically establish a breach or result in a penalty.
Relevant provisions: Sections 18–28.
Appeals & ADR
A person aggrieved by a Board order or direction can appeal to the Telecom Disputes Settlement and Appellate Tribunal, ordinarily within 60 days of receiving it. A delayed appeal may be accepted where sufficient cause is shown.
Where the Board considers a complaint suitable, it can direct the parties to attempt mediation. It may also accept a voluntary undertaking concerning compliance, such as a commitment to take corrective action or stop an activity.
Acceptance limits proceedings regarding its contents, while breach of the undertaking can lead to penalty proceedings.
Relevant provisions: Sections 29–32.
Penalties
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | Up to ₹250 crore |
| Failure to notify a personal data breach | Up to ₹200 crore |
| Breach of children’s data obligations | Up to ₹200 crore |
| Breach of SDF obligations | Up to ₹150 crore |
Maximum penalties include ₹250 crore for failure to take reasonable security safeguards, ₹200 crore for failure to notify a breach, ₹200 crore for breach of children’s data obligations and ₹150 crore for breach of SDF obligations. Data Principals can face up to ₹10,000 for breaching their duties. These are maximum amounts.
The Board considers factors such as the seriousness and duration of the breach, the type of data, repetition, mitigation and proportionality. Penalties go to the Consolidated Fund of India.
The Act does not provide a mechanism for awarding compensation to affected individuals.
Relevant provisions: Sections 33–34 and the Schedule.