Digital Personal Data Protection Act, 2023
Legislative action — a bill, act, or amendment that creates or modifies the legal framework. Carries binding force and shapes the rules under which citizens, institutions, and markets operate.
Summary
India's first comprehensive data protection legislation governing the processing of digital personal data. Establishes Data Protection Board, defines data principal and fiduciary rights and obligations, and provides for significant penalties.
Key Facts
Type Legislation
Source Historical Record
Published Friday, 11 August 2023
Affected Population ~850 million internet users, 75,000+ startups
Key Numbers
Rs 15,000 crore for Digital India initiatives
UPI: 14 billion monthly transactions
850 million+ Aadhaar-linked mobiles
20 million central + state government employees
Key Authorities
Key Stakeholders
Government Context
NDA II BJP-led NDA
Left Centre Right
Impact Assessment
7 /10
Impact Score Beneficiaries All internet users in India (~85 crore)
Coverage All states and UTs
Implementation Status Early Stage 30% implemented
Key Outcomes
- DPDP Act 2023 enacted — India's first comprehensive data law
- Data Protection Board constituted
- Rules for consent management and cross-border data flow notified
Challenges
- Government exemptions criticized
- Compliance readiness of SMEs
- Board independence concerns
SDG Alignment
Amendment History
2 changes recorded for this policy.
Description Thursday, 9 April 2026 via barandbench
Worldwide, data protection laws are based on a straightforward principle: collect and process as little data as possible to safeguard the privacy interests of residents. Many responsible technology companies also base their privacy practices on the concept of data minimisation. Even in the initial drafts of India’s data protection bills, including the explanatory note to the 2022 Bill, data minimisation was specifically identified as a key principle. The final version of the Digital Personal Dat
Description Monday, 13 April 2026 via hindustan_times
SC issues notice to Centre on PIL challenging provisions of digital personal data protection law