Digital Personal Data Protection Act, 2023
India's first comprehensive digital data protection law, built around plain-language principles (consent, purpose limitation, data minimisation) and enforced by a newly created Data Protection Board. It applies specifically to personal data processed in digital form.
Who it applies to
- Organisations processing digital personal data in India
- Non-Indian organisations offering goods or services to people in India
- Both routine data fiduciaries and “significant data fiduciaries”
Key requirements
- Clear, itemised consent from data principals
- Purpose limitation and data minimisation
- Verifiable parental consent for children's data
- Breach notification to the Board and affected individuals
- Enhanced obligations for significant data fiduciaries
Maximum penaltyUp to INR 250 crore (approx. £23M) per instance for failing to implement reasonable security safeguards
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The DPDP Act applies to: Organisations processing digital personal data in India; Non-Indian organisations offering goods or services to people in India; Both routine data fiduciaries and “significant data fiduciaries”.
The core obligations are: Clear, itemised consent from data principals; Purpose limitation and data minimisation; Verifiable parental consent for children's data; Breach notification to the Board and affected individuals; Enhanced obligations for significant data fiduciaries. Each is summarised in plain English above, with a link to the official text.
Effective: Enacted August 2023; obligations phasing in through 2027. Regulator: Data Protection Board of India / Ministry of Electronics & IT (MeitY).
Up to INR 250 crore (approx. £23M) per instance for failing to implement reasonable security safeguards.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the DPDP Act, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, rights requests and consent records sit in Consents Manager.
See how Praeferre automates DPDP Act compliance
Continuous monitoring, evidence and reporting for DPDP Act — alongside every other framework you need to satisfy.