Published on: 22nd January 2026
Authored By: Asmit Priyadarshi
Chanakya National Law University
Abstract
The Digital Personal Data Protection Act, 2023 (DPDP Act) signifies a landmark moment in Indian data privacy jurisprudence, introducing the nation’s first comprehensive legal framework regulating the collection, processing, and protection of digital personal data. This article critically analyzes the DPDP Act’s scope, structure, and impact, including its application to both domestic and foreign data processors, its robust consent and notice requirements, and the recognition of individual rights such as access, correction, erasure, and grievance redressal. The Act establishes clear duties for entities termed “data fiduciaries,” and introduces stricter compliance obligations for significant data handlers. Enforcement is anchored by the independent Data Protection Board of India, which wields investigatory and remedial powers, including the authority to impose substantial financial penalties for non-compliance.
The article contextualizes the DPDP Act’s comparative strengths and exemptions relative to global standards like the EU GDPR, and explores its practical consequences for businesses, consumers, and specific industry sectors. Critical examination highlights ongoing challenges regarding state discretion, implementation hurdles, and the balance between privacy rights and public interest. Ultimately, the DPDP Act is positioned as a foundation for advancing privacy protection in India, with its success dependent on regulatory clarity, enforcement rigor, and enhanced public awareness.
Introduction
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) marks a major turning point in how the country thinks about privacy and personal data. For years, people in India have been sharing more and more of their lives online through apps, social media, digital payments, and government platforms. With this came growing worries about data leaks, misuse of information, and companies collecting far more data than necessary. After long discussions, multiple drafts, and increasing pressure for a modern privacy law, India finally introduced its first full-fledged data protection legislation.
This Act is built on the idea that privacy is a fundamental right, as recognized by the Supreme Court in the Puttaswamy judgment. It tries to strike a balance between different needs like protecting the personal data of individuals, allowing businesses to use data responsibly for innovation and growth, and ensuring that the government can use data where genuinely required for public interest and national security.
The DPDP Act clearly lays out the responsibilities of organizations that handle personal data, gives citizens important rights over how their data is used, and creates a new regulatory body the Data Protection Board of India to keep a check on violations. Designed in a simple and technology-friendly way, the Act aims to build trust in India’s digital systems and bring the country closer to global standards of data protection.
Scope and Applicability
The Digital Personal Data Protection Act, 2023 (DPDP Act) has been designed to cover almost every situation where a person’s data is used in digital form. It applies not just to information collected directly through websites, apps, or online services, but also to data that was first taken offline and later stored or processed digitally. This makes the Act practical for India, where many services still start offline but quickly move to digital systems.
The Act covers all personal data processing that happens within India, no matter where the data originally came from. It also applies to companies or platforms outside India if they offer goods or services to people living in India. So, whether it’s a global social media site, an e-commerce platform, or a gaming app based abroad, they all need to follow the DPDP Act if they deal with Indian users’ data.
The term “personal data” is kept broad on purpose. It includes any piece of information that can identify a person either by itself or when combined with other details. In today’s world, even small bits of data can reveal a lot when put together, and the Act takes that reality into account.
Similarly, the meaning of “processing” is quite wide. It includes everything an organization might do with personal data like collecting it, storing it, organizing it, using it, sharing it with others, or even deleting it. If it happens in a digital or automated way, it falls under the Act.
Roles and Definitions
In India’s digital age, nearly every organization from banks and hospitals to online shops and government offices regularly handles personal data. The DPDP Act makes it clear that protecting this personal information isn’t just a technical challenge—it’s a legal and ethical duty.
Who are the key players?
- Data Principal: The individual whose personal data is collected or processed. Whether signing up for a bank account, booking a medical appointment online, or shopping on an app, your name, contact details, and other personal information make you the Data Principal. For children, parents or guardians step into this role, safeguarding the child’s right to privacy.
- Data Fiduciary: A Data Fiduciary is any person, business, government department, or other entity that collects and processes personal data, deciding how and why it’s used. Their duty is to treat that information with care, using it fairly, lawfully, and transparently.
Consent and Lawful Processing
One of the biggest changes brought by the DPDP Act, 2023 is its focus on clear and genuine consent. The Act makes it very simple: your personal data should not be used unless there is a valid reason for doing so and you have agreed to it. No more hidden permissions or complicated privacy policies that people often click without understanding. Consent now has to be free, informed, specific, and easy to understand.
Organizations must explain in plain, simple language what data they are collecting, why they need it, and how it will be used. You also have the right to withdraw your consent at any time, and once you do, the organization must stop using your data.
At the same time, the Act realizes that life doesn’t always allow for formal consent. So, it allows data to be processed without consent in certain important situations, such as:
- When required by law
- When the government needs it to provide public services
- During medical emergencies, disasters, or situations needing urgent help
- When needed for law enforcement or national security purposes
These exceptions ensure that essential services and emergency responses are not slowed down.The Act provides extra protection for children. Since they are more vulnerable online, it completely bans behavioral tracking, profiling, and targeted ads aimed at children. If any organization wants to process a child’s data, it must get verifiable parental consent and handle the data very carefully.
Rights of Data Principals
The DPDP Act gives individuals several important rights that put them in control of their own personal information. These rights make sure that people are not left in the dark about how their data is being used and can take action if something feels wrong.
One key right is the right to access. This means you can ask any organization what personal data they have about you and how they are using it. You can also find out if they’ve shared your data with anyone else. This helps you stay informed and understand exactly what is happening with your information.
Another major protection is the right to correct or erase your data. If something about you is incorrect, outdated, or incomplete, you can ask for it to be fixed. And if the organization no longer needs your data or if you simply don’t want them to have it anymore, you can request that it be deleted. This prevents your personal information from being stored forever or being used unnecessarily.
You also have the right to withdraw your consent. If you once agreed to let an organization, use your data but later change your mind, you can take back your permission. After that, they must stop using your data, unless there’s a strong legal reason that allows them to continue.
Finally, if you feel your data has been misused or your rights are not being respected, you can use your right to file a complaint. Every organization must provide a clear way for you to raise your concerns. And if they don’t resolve it, you can approach the Data Protection Board for help.
Duties and Accountability of Fiduciaries
Under the DPDP Act, organizations that collect or use personal data have several important responsibilities. They must be honest and transparent about why they need your data and can only use it for the purpose they clearly explained. They also need to collect only the minimum amount of data required.
It’s their job to make sure your data is correct and up to date, and they must delete it once they have finished using it for the stated purpose. Keeping data “just in case” is not allowed.
Security is a major responsibility too. Data Fiduciaries must use strong safeguards to protect your information from leaks, hacks, or misuse. If something goes wrong, they must respond quickly.
Some organizations like large companies or those handling sensitive information are labeled as Significant Data Fiduciaries. They have extra duties like regular audits, risk assessments, and appointing a Data Protection Officer. They must also have a registered presence in India so the government can easily hold them accountable.
Enforcement: Data Protection Board of India
To enforce the law, the DPDP Act sets up the Data Protection Board of India. Think of it as the watchdog for data protection.
Its job is to:
- Look into data breaches or complaints
- Make sure companies follow the law
- Order quick action if a breach puts people at risk
- Impose penalties when needed
The Board acts independently, allowing it to take fair, unbiased decisions and ensure trust in the entire system.
Penalties and Remedies
The Act includes serious financial penalties for organizations that fail to protect personal data. For example, if a company doesn’t maintain proper security and it results in a data breach, they can be fined up to ₹250 crore.
But the law doesn’t stop with companies individuals also have responsibilities. If someone files a bogus complaint or tries to misuse someone else’s identity while exercising their rights, they can also be penalized. This helps keep the system fair for both sides.
Cross-Border Data Transfers
Data often needs to travel across borders, especially for tech companies, cloud services, or global businesses. The DPDP Act allows personal data to be sent outside India, but only to countries approved by the government. This ensures that Indian citizens’ data is not sent somewhere unsafe or poorly regulated.
This system balances the needs of global business with the need to protect sensitive personal data.
Comparison with Global Standards
India’s DPDP Act takes inspiration from global data protection laws, especially the EU’s GDPR. Like GDPR, it focuses on consent, user rights, and accountable data handling.
But the DPDP Act also reflects India’s own needs. It gives the government broader powers and more room to act in areas like security, public services, and emergencies. It aims to protect privacy while also supporting India’s large digital population and fast-growing tech economy.
Criticisms and Challenges
While the DPDP Act represents a major milestone in India’s privacy journey, it has not been free from criticism. Many scholars and activists argue that the Act tilts the balance in favour of the government and large businesses rather than ordinary citizens. The broad exemptions granted to state agencies allowing them to process personal data without consent for reasons such as national security or public order raise concerns about potential overreach. Critics point out that these exemptions come with limited transparency and lack strong mechanisms for independent oversight.
Another major concern is enforcement. A law on paper is only as strong as the system enforcing it. Questions remain about whether the Data Protection Board will have sufficient resources, expertise, and autonomy to respond swiftly to violations. There is also apprehension that grievance redress might still feel distant and bureaucratic for everyday users who are not familiar with legal processes.
Implementation across India’s vast and diverse digital ecosystem poses additional hurdles. From multinational corporations to small startups and local vendors, everyone must adapt.
Conclusion
The Digital Personal Data Protection Act, 2023 marks a significant leap toward strengthening privacy rights in India. For the first time, citizens are granted clear and enforceable rights over their personal data. Businesses and government entities now have defined responsibilities and are held accountable through penalties and oversight mechanisms.
But the Act is not the final destination it is the beginning of an evolving regulatory framework. As technology grows more complex and interconnected, India will need continued refinement of its privacy standards, stronger institutional capacity, and widespread public awareness to ensure that the law works in practice, not just on paper. The success of the Act will depend on how well it balances innovation with individual privacy, corporate efficiency with user dignity, and national security with personal freedom.
References
- The Digital Personal Data Protection Act, 2023 (India) https://prsindia.org/billtrack/the-digital-personal-data-protection-bill-2023 accessed 18 November 2025.
- Drishti IAS, ‘DPDP Act, 2023 and DPDP Rules, 2025’ (Drishti IAS, 4 June 2025) https://www.drishtiias.com/daily-updates/daily-news-analysis/dpdp-act-2023-and-dpdp-rules-2025 accessed 18 November 2025.
- Nishith Desai Associates, ‘India’s Digital Personal Data Protection Act, 2023 – A Brief Overview’ (NDA, 6 August 2023) https://www.nishithdesai.com accessed 18 November 2025.
- ‘Digital Personal Data Protection Act, 2023’ Wikipedia https://en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Act,_2023 accessed 18 November 2025.
- Carnegie Endowment for International Peace, ‘Understanding India’s New Data Protection Law’ (2 October 2023) https://carnegieendowment.org/2023/10/02/understanding-india-new-data-protection-law accessed 18 November 2025.
- PwC India, ‘DPDP Act: Impact on E-Commerce and Services Sector’ (PwC, 17 September 2023) https://www.pwc.in/insights accessed 18 November 2025.
- Latham & Watkins, ‘India’s Digital Personal Data Protection Act 2023 vs. the GDPR’ (Latham & Watkins) https://www.lw.com accessed 18 November 2025.
- Legal500, ‘An Analysis of the DPDP Act & DPDP Rules 2025’ (Legal500, 7 May 2025) https://www.legal500.com accessed 18 November 2025.
- Cookie Script, ‘India’s Digital Personal Data Protection Act (DPDPA)’ (Cookie-Script, 23 April 2025) https://www.cookie-script.com accessed 18 November 2025.
- PIB, ‘DPDP Rules, 2025 Notified’ (PIB, 13 November 2025) https://pib.gov.in/PressReleasePage.aspx?PRID=1973301 accessed 18 November 2025.
- Jisasoftech, ‘Impact of the Digital Personal Data Protection Act 2023 – CryptoBind’ (Jisasoftech, 13 June 2025) https://jisasoftech.com/impact-of-digital-personal-data-protection-act-2023/ accessed 18 November 2025.
- The Legal School, ‘Data Privacy Laws in India: DPDPA 2023, IT Act 2000 & More’ (Legal School, 13 November 2025) https://thelegalschool.in/data-privacy-laws-in-india/ accessed 18 November 2025.
- PrivacyWorld, ‘The Impact of India’s New Digital Personal Data Protection Rules’ (PrivacyWorld Blog, 3 August 2025) https://www.privacyworld.blog accessed 18 November 2025.
- TNP Consultants, ‘Analysis of the Digital Personal Data Protection Act – India’ (TNP Consultants, 19 November 2024) https://tnpconsultants.com accessed 18 November 2025.
- SSRN, ‘India’s 2023 Data Privacy Act: Business/government …’ (SSRN, 15 August 2023) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4537485 accessed 18 November 2025.
- MeitY, ‘THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023’ (Ministry of Electronics & Information Technology) https://www.meity.gov.in/content/the-digital-personal-data-protection-act-2023 accessed 18 November 2025.
