Digital Personal Data Protection Act, 2023
Cite this
Citations are auto-generated; verify before publishing. The act classification is PolicyDhara's, not the source's.
Central or state Act — primary legislation passed by the legislature. Carries binding force and shapes the rules under which citizens, institutions, and markets operate.
Summary
India's first comprehensive data protection legislation governing the processing of digital personal data. Establishes Data Protection Board, defines data principal and fiduciary rights and obligations, and provides for significant penalties.
Key Facts
TypeAct
SourceHistorical Record
PublishedFriday, 11 August 2023
Affected Population~850 million internet users, 75,000+ startups
Key Numbers
Rs 15,000 crore for Digital India initiatives
UPI: 14 billion monthly transactions
850 million+ Aadhaar-linked mobiles
20 million central + state government employees
Key Authorities
Key Stakeholders
Government Context
NDA IIBJP-led NDA
LeftCentreRight
Impact Assessment
7/10
Impact ScoreBeneficiariesAll internet users in India (~85 crore)
CoverageAll states and UTs
Implementation StatusEarly Stage
30% implemented
Key Outcomes
- DPDP Act 2023 enacted — India's first comprehensive data law
- Data Protection Board constituted
- Rules for consent management and cross-border data flow notified
Challenges
- Government exemptions criticized
- Compliance readiness of SMEs
- Board independence concerns
SDG Alignment
Amendment History
5 changes recorded for this policy.
DescriptionThursday, 9 April 2026via barandbench
Worldwide, data protection laws are based on a straightforward principle: collect and process as little data as possible to safeguard the privacy interests of residents. Many responsible technology companies also base their privacy practices on the concept of data minimisation. Even in the initial drafts of India’s data protection bills, including the explanatory note to the 2022 Bill, data minimisation was specifically identified as a key principle. The final version of the Digital Personal Dat
DescriptionMonday, 13 April 2026via hindustan_times
SC issues notice to Centre on PIL challenging provisions of digital personal data protection law
TypeSunday, 19 July 2026via historical
act
SectorsTuesday, 11 August 2026via historical
Digital & Technology, Governance & Reform
DescriptionThursday, 27 August 2026via livelaw
On June 1, 2026, the Central Consumer Protection Authority (CCPA) penalised PhysicsWallah Limited with ₹5 lakh for deployment of dark patterns on its platform. The order narrates that PhysicsWallah maintained a pre-ticked “Donate for PW Foundation” checkbox which added ₹10 to the final checkout bill unless the user affirmatively unchecks it. The order also found that the “free courses” that PhysicsWallah offered were inaccessible unless every user affirmatively surrenders their phone number and