DPDP Act summary: what organisations need to understand

The Act applies to digital personal data processed in India when the data was collected digitally, or was collected offline and later digitised. It also applies to processing outside India when that processing is connected with offering goods or services to Data Principals in India.

The Act excludes personal data processed by an individual for a personal or domestic purpose. It also excludes personal data made or caused to be made publicly available by the Data Principal, or by another person who is required by law to make it public.

These are statutory boundaries, not a complete test for every situation. The facts of the processing matter.

The Act permits processing for a lawful purpose either on the basis of consent or for certain “legitimate uses” specified in the Act. An organisation should identify which basis applies to each purpose; consent is not the only basis described in the law.

When processing relies on consent

Consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. It must relate to personal data necessary for the specified purpose. A Data Principal must be able to withdraw consent, and withdrawing it must be as easy as giving it.

Notice comes before or with the request

Before or at the time consent is requested, the Data Principal must receive a notice explaining the personal data and purpose involved, along with information about how to exercise rights and make a complaint. The Rules require this notice to be clear and understandable independently of other information.

See sections 4–6 of the Act and Rule 3 of the DPDP Rules, 2025.

Subject to the Act and its prescribed process, a Data Principal can:

• Request a summary of personal data being processed and information about certain sharing.
• Ask for correction, completion or updating of personal data.
• Request erasure of personal data, subject to applicable legal retention requirements.
• Use the grievance redressal process and, after following the required steps, approach the Board.
• Nominate another individual to exercise rights in the event of death or incapacity, as provided by the Act.

The Act also sets duties for Data Principals, including providing authentic information when exercising rights and not impersonating another person. Rights and duties should be read with the detailed provisions and Rules.

The Act establishes the Data Protection Board of India. The Board can inquire into personal data breaches and complaints, exercise powers set out in the Act, and impose monetary penalties after following the prescribed process.

The Act’s Schedule assigns different maximum penalties to different contraventions. For example, failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore. The applicable amount depends on the contravention and the statutory factors the Board must consider.

Read Chapter V and the Schedule of the Act.

1. Map the digital personal data you handle, where it comes from, why you use it and which service providers process it.
2. Review notices, consent journeys and the channels available for withdrawing consent or making requests.
3. Review access controls, security safeguards, breach response plans, retention rules and processor contracts.
4. Assign owners for grievances, Data Principal requests and privacy questions, and record how each process works.
5. Check which parts of the Act and Rules apply to your organisation and when those provisions commence.

These are general preparation ideas, not a complete compliance checklist. The Act’s application depends on your processing activities, circumstances and any applicable exemptions.