What is DPDP? India's data protection law, explained from the official text

DPDP stands for Digital Personal Data Protection. Depending on context, people use the abbreviation for the law itself, the DPDP Act 2023, or for the framework as a whole, the Act together with the DPDP Rules 2025. This page is the short, sourced version of both.

The DPDP Act 2023

The Digital Personal Data Protection Act, 2023 is Act No. 22 of 2023, enacted by Parliament with the President's assent on 11 August 2023. Its purpose fits in one sentence, its own:

"An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto."

Long title of the DPDP Act 2023.

The Act has 44 sections and one Schedule of monetary penalties. In outline: it defines who is who (the Data Principal is the individual the data is about, the Data Fiduciary decides why and how data is processed, the Data Processor processes on a fiduciary's behalf), permits processing only on consent or certain legitimate uses, sets obligations for fiduciaries such as notice, security safeguards, breach intimation and erasure, gives individuals rights of access, correction, erasure, grievance redressal and nomination, creates the Data Protection Board of India to enforce all of it, and caps penalties at amounts up to two hundred and fifty crore rupees. Every section is on this site with its official Gazette text: start at the Act explorer.

The DPDP Rules 2025

The Act delegates the operational detail to rules. The DPDP Rules 2025 were notified as G.S.R. 846(E) on 13 November 2025 and answer the practical questions: what a notice must contain, what reasonable security safeguards include, how breach intimation works and on what clocks, how verifiable consent for children is obtained, and how the Board functions. The 23 rules and 7 Schedules are on the Rules explorer.

Who DPDP applies to

Section 3 sets the reach. The Act applies to digital personal data processed within India, whether collected digitally or digitised later, and it applies outside India where the processing is connected with any activity related to offering goods or services to Data Principals in India. It does not apply to personal data processed by an individual for personal or domestic purposes, or to data made publicly available by the Data Principal herself or by anyone required by law to publish it. Whether it applies to your organisation, and in what role, is what the applicability checker works out from the official criteria.

When DPDP applies

Neither the Act nor the Rules switched on all at once. Commencement notification G.S.R. 843(E) and Rule 1 phase them in three groups each:

• In force since 13 November 2025: the definitions, the Data Protection Board provisions and related machinery of the Act; Rules 1, 2 and 17 to 21, which set the Board up.
• Due at one year, computed as 13 November 2026: Consent Manager registration under section 6(9) and Rule 4, and the Board's power to act on intimation that a Consent Manager has breached a registration condition.
• Due at eighteen months, computed as 13 May 2027: the main obligations, including notice, consent, security safeguards, breach intimation, individual rights, and the penalties chapter.

Both computed dates are interpretation until officially confirmed; the timeline tracks each milestone with its primary source and verification date.

Where to go next

If you handle other people's data, start with the applicability checker and the company action plan. If it is your own data you are thinking about, the individual rights assistant explains what you can ask for and how. And every legal claim in this article carries its exact official source below, which is the standard for everything on this site.