Privacy & Data Protection · India
Digital Personal Data Protection Act, 2023
India's first comprehensive digital data protection law, built around plain-language principles (consent, purpose limitation, data minimisation) and enforced by a newly created Data Protection Board. It applies specifically to personal data processed in digital form.
REGULATORData Protection Board of India / Ministry of Electronics & IT (MeitY)
REGIONIndia
EFFECTIVEEnacted August 2023; obligations phasing in through 2027
Who it applies to
- Organisations processing digital personal data in India
- Non-Indian organisations offering goods or services to people in India
- Both routine data fiduciaries and “significant data fiduciaries”
Key requirements
- Clear, itemised consent from data principals
- Purpose limitation and data minimisation
- Verifiable parental consent for children's data
- Breach notification to the Board and affected individuals
- Enhanced obligations for significant data fiduciaries
Maximum penaltyUp to INR 250 crore (approx. £23M) per instance for failing to implement reasonable security safeguards
Go to the source
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Start your compliance journey
See how Praeferre automates DPDP Act compliance
Continuous monitoring, evidence and reporting for DPDP Act — alongside every other framework you need to satisfy.