India’s Digital Personal Data Protection Act: What It Means for You
India now has a dedicated data protection law, but most of it is not yet in force. With the DPDP Act explained in plain terms, this guide sets out what the Digital Personal Data Protection Act, 2023 and its 2025 Rules promise you, what companies will have to do, and the dates on which each part switches on.
If you live in India, you have probably agreed to hundreds of privacy policies without reading one. The DPDP framework is meant to change what those requests look like and what happens afterwards: shorter notices, consent you can withdraw as easily as you gave it, and a regulator you can complain to.
This article is general information, not legal advice. Dates and figures below are stated as of October 2026 and are linked to the official text wherever possible.
What the law is and who it covers
The Digital Personal Data Protection Act, 2023 applies to personal data in digital form, or data collected offline and later digitised. According to the government's backgrounder of 17 November 2025, Parliament enacted it on 11 August 2023. The detailed Digital Personal Data Protection Rules, 2025 were published as G.S.R. 846(E), dated 13 November 2025, after a draft released on 3 January 2025. The Press Information Bureau announced them on 14 November 2025 and said the consultation drew 6,915 inputs.
The law uses its own vocabulary, and it helps to learn four terms:
- Data Principal: you, the person the data is about. For a child, this includes the parent or lawful guardian.
- Data Fiduciary: the organisation that decides why and how your data is processed, such as a bank, an app or a hospital.
- Data Processor: a company that processes data on a fiduciary's behalf, such as a cloud host.
- Consent Manager: a registered platform through which you can give, manage, review or withdraw consent across services. Under the Rules it must be an Indian company with a net worth of at least ₹2 crore.
When each part takes effect
The single most misunderstood point about the law is timing. Rule 1 of the 2025 Rules splits commencement into three phases, and a parallel notification does the same for sections of the Act. The table below follows the Rules' text and a section-by-section summary by Acuity Law.
| Phase | Date | What starts |
|---|---|---|
| Immediate | 13 November 2025 (publication) | Definitions; constitution and procedures of the Data Protection Board (Act sections 18–26, Rules 17–21); the amendment to the Right to Information Act (section 44(3)) |
| One year | About 13 November 2026 | Registration and obligations of Consent Managers (section 6(9), Rule 4) and the Board's power to inquire into them |
| Eighteen months | About 13 May 2027 | Almost everything that affects you directly: notice and consent, legitimate uses, security safeguards, breach reporting, children's data, Significant Data Fiduciaries, your rights and duties, cross-border transfers, exemptions and penalties |
Published analyses differ by one day on the exact anniversary dates (some give 12 November 2026 and 12 May 2027), so treat the day as approximate until a regulator or court confirms it.
There is also a live proposal to bring the dates forward. In January 2026, Storyboard18 reported that the Ministry of Electronics and Information Technology (MeitY) had asked platforms for views on cutting the 18-month window to 12 months, with feedback due by 4 February 2026. Officials told the outlet that no final decision had been taken, and no amending notification had been located for this article as of October 2026.
Until the main provisions start, the older regime under the Information Technology Act, 2000, including section 43A, continues to apply. The DPDP Act omits section 43A from the date the core provisions commence.
Your rights as a Data Principal
Chapter III of the Act and Rule 14 set out what you will be able to ask for. The rights apply to data you have given with consent, or that is processed under certain "legitimate uses" such as data you volunteered for a specific purpose.
Right to information about your data
Under section 11, you can request a summary of the personal data a fiduciary holds and what it does with it, plus the identities of other fiduciaries and processors it has shared your data with. Disclosure of sharing with law enforcement agencies for investigating offences is excluded.
Right to correction, completion, updating and erasure
Section 12 lets you have inaccurate data corrected, incomplete data completed and outdated data updated. You can also ask for erasure, but a company may keep data if it still needs it for the purpose you agreed to or if another law requires it to be retained.
Right to grievance redressal
Every fiduciary and Consent Manager must offer a readily available way to complain. Rule 14(3) sets a maximum response period of 90 days. Under section 13(3) you must use this route before going to the Data Protection Board.
Right to nominate
Section 14 lets you nominate another individual to exercise your rights if you die or become unable to act yourself.
Right to withdraw consent
Section 6(4) says withdrawing consent must be as easy as giving it. Withdrawal does not undo processing that already happened, and a service may stop offering you features that depend on the data. The Act's own illustration: if you withdraw consent from a shopping app, it can stop you placing new orders but must still deliver what you have paid for.
The law treats consent as something you can take back, not a one-time signature buried in the terms.
What companies must do
When the main provisions apply, the Rules impose concrete duties on every Data Fiduciary:
- A standalone notice. Rule 3 requires a notice understandable on its own, with an itemised description of the data and the specific purposes, plus a link to withdraw consent, exercise rights and complain to the Board.
- Security safeguards. Rule 6 lists minimum measures including encryption, masking or tokenisation, access controls, monitoring logs and backups, with logs kept for a year.
- Breach notification. Under Rule 7, affected users must be told "without delay" what happened, the likely consequences and what they can do. The Board must get an initial report without delay and a detailed one within 72 hours.
- Deleting data you no longer use. Under Rule 8 and the Third Schedule, large e-commerce platforms and social media intermediaries (at least 2 crore registered users in India) and online gaming intermediaries (at least 50 lakh) must erase data three years after you last used the service, with at least 48 hours' warning before deletion.
- A named contact. Rule 9 requires a published contact for privacy questions, either a Data Protection Officer or another responsible person.
Companies the government designates as Significant Data Fiduciaries carry extra obligations under Rule 13: an annual Data Protection Impact Assessment and audit, checks that their algorithms do not put users' rights at risk, and, for data a government committee specifies, a bar on transfer outside India.
Children's data
The Act defines a child as anyone under 18. Section 9 requires verifiable consent from a parent or lawful guardian before a child's data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 explains how a platform should check that the person consenting is an identifiable adult, either from details it already holds or through an identity and age token, which may be issued via a DigiLocker-type service.
The Fourth Schedule carves out exceptions. Hospitals and health professionals, schools (for educational activity and safety), crèches and school transport operators (for tracking location for safety), and services creating an email-only account are among those exempted from some of these duties, within stated limits.
The Data Protection Board and penalties
The Data Protection Board of India is the enforcement body. The government describes it as a "fully digital" body with four members, online complaint filing and case tracking, and appeals to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), according to the PIB backgrounder.
The Board existed in law from November 2025, but staffing it has taken longer. A LiveLaw commentary published on 1 August 2026 stated that no Chairperson or Members had yet been appointed, although MeitY had sought nominations on 6 May 2026 and issued a further notification on 6 June 2026.
The Schedule to the Act sets maximum penalties on fiduciaries:
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a data breach | ₹250 crore |
| Failing to notify the Board or affected users of a breach | ₹200 crore |
| Breaching the additional obligations on children's data | ₹200 crore |
| Breaching the additional obligations of a Significant Data Fiduciary | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
| A Data Principal breaching their duties under section 15 | ₹10,000 |
Under section 34, penalties are credited to the Consolidated Fund of India, not paid to the affected person. The Act does not set up a compensation scheme for individuals in the way some foreign laws do.
Your duties, and the exemptions
Section 15 places duties on you as well. You must not impersonate someone else, suppress material information when providing data for official documents, file false or frivolous complaints, or supply unverifiable information when asking for correction or erasure. The Board can warn or impose costs on a complainant it considers frivolous.
The law also contains broad exemptions. Section 17 lets the central government exempt notified state agencies in the interests of the sovereignty and integrity of India, security of the State, friendly relations with foreign States and public order, and Rule 16 exempts processing for research, archiving or statistics if set standards are met.
The criticisms
The framework has drawn sustained criticism, most of it focused on the state's powers and on transparency.
- The RTI amendment. Section 44(3), in force since November 2025, rewrites section 8(1)(j) of the Right to Information Act on personal information. The government says in its backgrounder that the public-interest override in section 8(2) "remains fully operative". Transparency campaigners argue the change will make it harder to obtain information about public officials.
- Court challenge. On 16 February 2026, according to the Internet Freedom Foundation, the Supreme Court issued notice on petitions including one by the National Campaign for Peoples' Right to Information, referred the core questions to a larger bench and declined to stay the framework for now.
- Delay, state access and the Board's independence. In its statement of 14 November 2025, the Internet Freedom Foundation urged the government "to avoid long deferrals", argued that Rule 23 "grants unchecked power to the State to demand personal data" from companies without consent, and said executive control over Board appointments "deepens executive control". The government's stated position, in its press release, is that the phased timeline allows organisations a smooth transition.
What you can do now
The main rights are not enforceable until around May 2027, but you can prepare, and good habits help regardless of the law.
- Audit app permissions. On your phone, review which apps can see contacts, location, photos and SMS, and switch off anything that does not need it.
- Find each service's privacy contact. For your bank, telecom operator and the large platforms you use, note where the grievance or privacy contact is published. Rule 9 will require this to be prominent.
- Keep records. When you give consent for something unusual, such as a loan app wanting your contacts, take a screenshot of the notice. If you later withdraw consent or complain, the date and wording will matter.
- Watch for new-style notices. From 2027, notices should list itemised data and purposes. A notice that asks for "all data for any purpose" will be a red flag.
- Plan a nomination. Think about who you would nominate to exercise your data rights if you could not, in the same way you nominate for a bank account.
- Act quickly on breach alerts. If a company tells you your data has leaked, change passwords, turn on two-factor authentication and watch bank statements. From 2027, the notice must tell you what safety steps you can take.
- Be careful with Consent Managers. Once registration opens, check that any Consent Manager you sign up with appears on the Board's published list.
For how India's law compares with Europe's GDPR and US state laws, see our consumer guide to the new digital privacy acts.
The bottom line
The DPDP Act gives Indians, for the first time, a dedicated statute with specific rights over personal data, a 90-day response deadline and penalties large enough to matter to big platforms. But most of it is still on a timer. Between now and the core commencement date, the things to watch are whether the Board is staffed, whether the government shortens the timeline, and what the Supreme Court decides on the RTI questions.
Frequently asked questions
Can I use my DPDP rights today?
Not fully. As of October 2026, the rights in sections 11 to 14 and the duties on companies are scheduled to start 18 months after the Rules' publication, around May 2027. Until then, you can ask companies for information under their own policies and the older IT Act rules.
How long does a company have to respond to my request?
Rule 14(3) requires fiduciaries and Consent Managers to respond within a reasonable period, not exceeding 90 days, once the provision is in force.
Will I get compensation if my data is leaked?
The Act provides for penalties paid to the government, not compensation to individuals. Other legal routes, such as consumer or civil claims, may exist depending on the facts.
Does the law apply to foreign apps?
Yes, where they process digital personal data in connection with offering goods or services to people in India, as set out in section 3 of the Act.
What age counts as a child?
Under 18. That is higher than many foreign laws, which typically set the threshold at 13 to 16.
Sources
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India / Ministry of Electronics and Information Technology, 2023.
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), Gazette of India / Ministry of Electronics and Information Technology, 2025.
- Government notifies DPDP Rules to empower citizens and protect privacy, Press Information Bureau, 2025.
- DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use, Press Information Bureau, 2025.
- Notification of Digital Personal Data Protection Law in India: Certain Key Timelines, Acuity Law, 2025.
- MeitY seeks industry views on fast-tracking DPDP Act rollout, proposes 12-month compliance timeline, Storyboard18, 2026.
- India's Data Protection Board: Established In Law, Absent In Fact, LiveLaw, 2026.
- IFF's Initial Statement on the Notification of the Digital Data Protection Rules, 2025, Internet Freedom Foundation, 2025.
- Supreme Court Issues Notice on Constitutional Challenge to The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, Internet Freedom Foundation, 2026.
