The Digital Personal Data Protection Act, 2023

What it does

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) regulates the processing of personal data. It speaks of a data fiduciary, the person who decides the purpose and means of processing, a data principal, the individual the data relates to, and a data processor, who processes on the fiduciary's behalf. A consent manager is a person through whom a data principal gives, manages and withdraws consent. A significant data fiduciary is one notified for heavier duties.

Section 3(a) applies the Act to personal data collected in digital form and to data collected on paper and digitised later. Section 4 is the ground on which any processing has to stand. Section 5 requires notice, and section 6 deals with consent. Section 8 states the general obligations of a data fiduciary. Section 9 deals with children, who are individuals under eighteen, and requires verifiable consent of a parent before a child's data is processed, with a bar on tracking, behavioural monitoring and targeted advertising directed at children.

Who it binds

Data fiduciaries and, through them, the processors they engage. A fiduciary remains responsible for processing done on its behalf whatever the contract says. The Act is addressed to the organisation, and the individual is the person protected. The Data Protection Board of India enforces the Act, with its powers and procedure set out in the Act itself.

What has changed, and when

The Act is of 2023, and its commencement was staged by a notification of November 2025. On 13 November 2025 the Ministry of Electronics and Information Technology issued three instruments: the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), a notification appointing the dates on which the Act's provisions come into force (G.S.R. 843(E)), and a notification establishing the Data Protection Board (G.S.R. 844(E)).

The commencement is in three steps. On 13 November 2025 came the definitions, the sections that constitute the Board and govern its members and staff, and the rule-making and related powers, which is the apparatus of enforcement. On 13 November 2026 comes section 6(9) and one clause of section 27. On 13 May 2027 comes the substance of the Act, sections 3 to 5, the remainder of section 6, sections 7 to 17, most of section 27, sections 28 to 34 (which include the Board's procedure and the appeal route) and sections 36 and 37. The regulator exists now, but the duties do not bind until the third date.

What turns on it in practice

The recurring practical point is the timetable. A business that reads the Act as already binding will over-build, and one that reads it as distant will under-build. The notice, security measures, breach reporting, erasure and the rights machinery are due on 13 May 2027, so contracts, systems and vendor arrangements entered into now need to be ready for that date.

The second is children. Section 9 treats anyone under eighteen as a child, so a university that admits a seventeen-year-old is processing a child's data for that student until her birthday. Rule 12 of the Rules lifts the parental consent duty and the bar on tracking and monitoring for an educational institution, but only for tracking and behavioural monitoring for its educational activities or for the safety of enrolled children. Admission, fee and examination records sit outside that condition, and the bar on detrimental processing is not lifted.

The third is technology contracting. A data fiduciary cannot hand its responsibility to a vendor, including an artificial intelligence vendor, by contract. The Act is the instrument expected to govern most use of personal data by artificial intelligence, and for a technology-driven business it is the main statute behind advisory work on data protection, technology contracting and product compliance.