Data protection laws in India are anchored by the Digital Personal Data Protection Act of 2023, operationalized through the Digital Personal Data Protection Rules notified on November 13, 2025. Together they form a single enforceable regime covering how organizations collect, store, and use the digital personal data of Indian residents, with a phased compliance timeline extending into mid-2027 and penalties reaching ₹250 crore for the most serious violations. The law replaces India’s earlier patchwork of IT Act provisions with a purpose-built statute, a dedicated regulator, and enforceable rights for individuals.
Who and What the Law Covers
The DPDP Act applies to any data about a living individual who can be identified by it. Names, phone numbers, biometric identifiers, and location data all fall within scope. The Act governs digital personal data specifically, meaning information collected digitally from the start or collected on paper and later converted into electronic form.
Reach extends beyond India’s borders. Organizations located anywhere in the world are covered if they process digital personal data in connection with offering goods or services to individuals in India. A company operating an app or website that targets Indian users faces the same obligations as a domestic business.
Two carve-outs matter. The law does not apply to personal data processed by an individual purely for personal or domestic purposes. It also does not cover data that the individual has voluntarily made public, or that another person was legally required to make publicly available.
Section 44 of the Act omits Section 43A of the IT Act of 2000, which had been the legal basis for the 2011 Rules on sensitive personal data. Once the relevant DPDP provisions take effect, those older rules no longer apply to digital personal data.
Consent and Notice
Consent is central. Under Section 6, any consent a person gives must be free, specific, informed, unconditional, and unambiguous, demonstrated through a clear affirmative action. It only covers the personal data necessary for the specific purpose stated at the time of collection.
Before requesting consent, the organization must give notice under Section 5. That notice must state what personal data will be collected, the purpose of processing, how to withdraw consent, and how to file a complaint with the Data Protection Board. It must be available in English or any of the 22 languages listed in the Eighth Schedule of the Constitution.
Withdrawing consent must be as easy as giving it. Once a person withdraws, the organization must stop processing within a reasonable time and direct any processors it uses to do the same. Processing that took place before withdrawal remains lawful.
The Act also creates a category called Consent Managers: registered intermediaries through which individuals can give, review, and withdraw consent across multiple organizations. Consent Managers must register with the Data Protection Board and meet prescribed technical, operational, and financial conditions.
When Consent Is Not Required
Certain “legitimate uses” allow processing without fresh consent. These include situations where the individual voluntarily provides data for a specific purpose, where an employer processes employee data for employment-related functions, and where processing is necessary during a medical emergency. For data collected before the Act took effect, organizations must send a notice describing what data they hold and how to exercise rights; if the individual does not withdraw consent, processing can continue.
What Organizations Must Do
Any entity that determines the purpose and means of processing personal data is a “data fiduciary.” Section 8 sets out the core obligations, and none of them can be shifted to a data processor or to the individual by contract.
- Keep personal data complete, accurate, and consistent when it will be used to make decisions affecting the individual or shared with another fiduciary.
- Take reasonable security measures to prevent data breaches, including for processing done by third-party processors on the fiduciary’s behalf.
- Notify both the Data Protection Board and each affected individual if a breach occurs, in the prescribed form and manner.
- Erase personal data once the individual withdraws consent or the original purpose is no longer being served. If the individual neither contacts the fiduciary nor exercises any data rights for a prescribed period, the purpose is deemed fulfilled and deletion becomes mandatory.
- Publish business contact details of a Data Protection Officer, if one is required, or another authorized person who can answer questions about processing.
- Set up an effective grievance mechanism for individuals to raise and resolve complaints.
Extra Rules for Significant Data Fiduciaries
The government can designate certain organizations as Significant Data Fiduciaries based on the volume and sensitivity of data they handle, the risk their processing poses, and its potential impact on national security or public order. Section 10 adds three requirements on top of the ordinary obligations:
- Appoint a Data Protection Officer based in India who reports to the board of directors or equivalent governing body and serves as the point of contact for the regulator and for individuals filing grievances. This formal DPO requirement applies only to Significant Data Fiduciaries.
- Appoint an independent data auditor to evaluate compliance with the Act.
- Conduct periodic Data Protection Impact Assessments that describe the purpose of processing, evaluate risks to individuals’ rights, and outline how those risks will be managed.
Rights Individuals Have
The person whose data is being processed is a “data principal.” Sections 11 through 14 give them a set of enforceable rights.
- Request a summary of the personal data being processed and the identities of any other fiduciaries or processors with whom it has been shared.
- Demand corrections or updates to inaccurate or incomplete data, and request erasure once the original purpose is fulfilled or after withdrawing consent.
- Escalate unresolved complaints to the Data Protection Board after the fiduciary’s grievance process.
- Nominate another adult individual, under Section 14, to exercise their data rights in the event of death or incapacity. The nominee must be a person, not a company, and nominations cannot be made jointly to multiple people.
Duties run alongside these rights. Section 15 requires individuals to provide only authentic information, refrain from filing false or frivolous complaints, and avoid impersonation or misleading documentation. Breaching these duties can bring a penalty of up to ₹10,000.
Children’s Data
The Act defines a child as anyone under 18. Section 9 requires verifiable consent from a parent or lawful guardian before processing any child’s personal data. The same rule applies to individuals with disabilities who have a lawful guardian.
Beyond parental consent, fiduciaries are prohibited from processing children’s data in any way likely to cause a detrimental effect on a child’s well-being. Tracking, behavioral monitoring, and targeted advertising directed at children are all banned. The government can exempt certain classes of fiduciaries from these restrictions for specific purposes and can lower the effective age threshold for platforms that demonstrate their processing of children’s data is verifiably safe.
Sending Data Outside India
Under Section 16, the government can restrict transfers of personal data to specific countries or territories by notification. This is a blacklist approach: transfers are generally permitted unless the government blocks a particular destination. As of early 2026, no countries have been formally blacklisted.
Other Indian laws that impose stricter transfer restrictions continue to apply. Sector regulators such as the Reserve Bank of India can keep enforcing their own localization requirements on top of the DPDP Act. Significant Data Fiduciaries face tighter scrutiny: under the Rules, they must implement measures to prevent the transfer of government-specified personal data and related traffic data outside India.
Government and Law Enforcement Exemptions
Section 17 carves out broad exemptions that define the practical limits of the law’s protection. The central government can notify specific state instrumentalities as exempt from essentially the entire Act when processing data in the interests of national sovereignty, state security, friendly relations with foreign states, maintenance of public order, or prevention of certain criminal offenses. Personal data furnished by these agencies to the central government also falls outside the Act.
Additional exemptions cover processing that is necessary for:
- Pursuing or defending a legal claim.
- Courts, tribunals, and regulatory bodies performing their official duties.
- Prevention, detection, investigation, or prosecution of criminal offenses.
- Mergers, demergers, or transfers of undertakings approved by a court or competent authority.
- Ascertaining the financial position of a person who has defaulted on a loan from a financial institution.
- Research, archiving, or statistical purposes, provided the data is not used to make decisions about specific individuals.
State agencies are also exempt from certain retention obligations and from the individual’s right to request erasure. The result is that government surveillance and law enforcement data collection operate under significantly fewer restrictions than private-sector processing, a feature that has drawn criticism from privacy advocates.
Penalties
The Act’s penalty schedule is structured across seven tiers. All figures are ceilings; the actual amount depends on the nature and gravity of the breach, its duration, the type of data involved, and whether the fiduciary took steps to mitigate the harm.
- Failing to maintain reasonable security safeguards to prevent a data breach: up to ₹250 crore (approximately $30 million).
- Failing to notify the Board or affected individuals of a data breach: up to ₹200 crore.
- Breaching obligations related to children’s data: up to ₹200 crore.
- Breaching Significant Data Fiduciary obligations, including DPO appointment, audits, and impact assessments: up to ₹150 crore.
- Breaching any other provision of the Act or Rules not specifically listed: up to ₹50 crore.
- Individuals breaching their duties, such as filing false complaints or providing inaccurate information: up to ₹10,000.
- Breaching the terms of a voluntary undertaking accepted by the Board: up to the penalty that would have applied for the original violation.
Penalties apply per instance. An organization that suffers multiple breaches or violates multiple provisions faces separate liability for each one, which can create enormous cumulative exposure for companies handling data at scale.
Enforcement and Appeals
The Data Protection Board of India is the enforcement body. It was formally established through a gazette notification on November 13, 2025, alongside the Rules. As of early 2026, the appointment of the Chairperson and members through the prescribed search-cum-selection committee process remains pending, so the Board is not yet fully operational.
Once staffed, the Board investigates complaints, conducts inquiries into suspected breaches, and issues directions to fiduciaries. It has the authority to summon organizations, review evidence, and impose penalties. It is an administrative body with adjudicatory powers, not a court, and is designed to operate as a digital office wherever practicable.
Anyone aggrieved by a Board order can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Under Section 29, the appeal must be filed within 60 days of receiving the order, though TDSAT can accept late filings for sufficient cause. TDSAT is expected to resolve appeals within six months and must record written reasons if it misses that deadline. A further appeal lies to the Supreme Court of India, to be filed within 90 days of the tribunal’s order under the provisions of the TRAI Act.
When It All Takes Effect
The Rules roll out in phases from the November 13, 2025 notification date. Provisions establishing the Data Protection Board and its appointment procedures took effect immediately. Rule 4 takes effect one year after notification, around November 2026. The bulk of the substantive rules, covering consent mechanisms, data principal rights, grievance redressal, Significant Data Fiduciary obligations, and enforcement, take effect 18 months after notification, around May 2027.
For any organization operating in India or serving Indian users, the compliance window is closing. Building consent mechanisms, breach notification procedures, and grievance redressal systems takes time, and the penalty structure offers little sympathy to organizations that wait.