Digital Personal Data Protection Act, 2023
A section-by-section guide to India's data privacy law. Read the Gazette legal text alongside practical plain-English explanations, engineering checklists, and penalty risk assessments for each section.
High-Impact Sections for Digital Businesses
Consent & Notices
Free, specific, unbundled consent, a language option across 22 scheduled languages, and easy withdrawal.
Security & Breaches
Mandatory security safeguards, breach notifications to the Board, data erasure, and processor contracts.
Children's Data
Strict ban on behavioral monitoring, targeted ads, and mandatory parental consent for minors under 18.
Statutory Fines
Complete schedule of maximum financial penalties up to ₹250 Crore for security lapses and violations.
Browse by Chapter
Official Text
Preliminary
Obligations of Data Fiduciary
Rights and Duties of Data Principal
Special Provisions
Data Protection Board of India
Powers, Functions and Procedure of Board
Appeal and Alternate Dispute Resolution
Penalties and Adjudication
Miscellaneous
MeitY Orders & Subordinate Rules
DPDP Act FAQ
What is the DPDP Act 2023? +
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's data privacy law. It received Presidential assent on 11 August 2023 and has 9 chapters, 44 sections and one Schedule of penalties. It governs how businesses (Data Fiduciaries) collect and use the digital personal data of individuals (Data Principals).
Is the DPDP Act in force? +
Partly. The Data Protection Board provisions took effect on 13 November 2025. Consent Manager registration starts on 13 November 2026. All other obligations, including notice, consent, security, breach reporting, children's data, user rights and penalties, apply from 13 May 2027.
Who does the DPDP Act apply to? +
It applies to digital personal data processed in India, and to processing outside India that is connected to offering goods or services to people in India. It does not apply to purely personal or domestic use, or to data a person has made public themselves.
What are the penalties under the DPDP Act? +
The Schedule sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for breaching children's data rules, ₹150 crore for Significant Data Fiduciary breaches, ₹10,000 for breaches of a user's duties, and ₹50 crore for any other breach.
Does the DPDP Act apply to small businesses and startups? +
Yes. There is no general small-business exemption. Section 17(3) lets the government exempt notified startups from some duties, such as notice and the right to access, but no such notification has been issued as of October 2026.
Who is a child under the DPDP Act? +
Anyone under 18. Businesses need verifiable consent from a parent before processing a child's data, and must not track, behaviourally monitor or target ads at children, except in narrow cases listed in the DPDP Rules 2025.
How quickly must a data breach be reported? +
Under Rule 7 of the DPDP Rules 2025, a business must inform affected users and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach.
What changed with the 2026 Removal of Difficulties Order? +
The order (S.O. 5458(E), dated 5 October 2026) made two wording fixes: it inserted the word "of" in Section 9(1), and changed "periodic audit" to "periodic data audit" in Section 10(2)(c)(ii). It did not add new duties or change commencement dates.
Audit Your Website for DPDP Act Compliance
Don't wait for regulatory notices. Scan your website right now to see every tracker, cookie, and marketing script that fires before affirmative consent is recorded.