What is the DPDP Act?

Question

Accepted Answer

The DPDP Act, 2023 is India's primary data protection law, enacted on 11 August 2023 and being operationalised through phased rules and the Data Protection Board. It applies to any business — Indian or foreign — that processes the digital personal data of individuals in India.

It defines two key roles: the Data Fiduciary (the organisation that decides why and how data is processed) and the Data Principal (the individual whose data is being processed). Every Fiduciary must obtain valid consent, provide clear notices, honour user rights (access, correction, deletion, nomination, grievance), protect data with reasonable safeguards, and notify breaches.

Non-compliance can attract penalties of up to ₹250 crore per violation, adjudicated by the Data Protection Board of India.