The parliament of India has passed the Digital Personal Data Protection Act 2023 (“DPDP Act” or “Act”) on 11th August 2023.
The goal of the DPDP Act is to outline guidelines for processing digital personal data in a way that acknowledges both individuals' rights to privacy protection and the requirement to process personal data for legal purposes.
It provides the rights to data principals (data subjects), outline obligations of data fiduciaries (data handlers/controllers), and furnish penalties for non-compliance. It applies to the processing of digital personal data within India, whether collected online or offline.
DPDP Act has extraterritorial application if the processing is in connection with offering goods or services to data principals within India.
Following the enactment of the Act, the Ministry of Electronics and Information Technology published the Digital Personal Data Protection Rules, 2025 (DPDP Rules), on November 13, 2025. These rules provide the operational framework for the Act, detailing specific procedures for verifiable parental consent, timelines for data erasure, and the registration of Consent Managers to help individuals manage their data permissions. The rules related to the Data Protection Board are already in force, however, consent manager related rules take effect 12 months after finalization in November 2026, with all other obligations applying after 18 months, i.e, May 2027.
