India’s Digital Personal Data Protection Act (DPDPA), 2023, which received Presidential assent on August 11, 2023, represents the country’s first comprehensive legislation dedicated to protecting personal data of individuals in the digital space. As the government works on implementing the framework through the creation of the Data Protection Board and the release of draft rules, it is important to understand the Act’s key provisions and the challenges ahead.
Background and Legislative History
India’s journey towards a dedicated data protection law has been long and complex. The process began in earnest following the Supreme Court’s landmark judgment in Justice K.S. Puttaswamy v. Union of India (2017), which recognised the right to privacy as a fundamental right under Article 21 of the Constitution. The Justice B.N. Srikrishna Committee was then appointed to draft a data protection bill, which went through multiple versions before the DPDPA was finally enacted in 2023.
Key Provisions of the DPDPA
The DPDPA applies to the processing of digital personal data within India and to processing outside India if the processing involves provision of goods or services in India. It establishes the concept of a “Data Principal” (the individual whose data is being processed) and a “Data Fiduciary” (the entity that determines the purpose and means of processing).
Data Fiduciaries are required to obtain consent from Data Principals before processing their data, subject to certain legitimate uses specified in the Act. The Act creates “Significant Data Fiduciaries” — entities that handle particularly sensitive or large volumes of data — who are subject to additional obligations including appointment of a Data Auditor and Data Protection Officer.
Rights of Data Principals
The Act grants Data Principals several rights, including the right to access information about their personal data, the right to correction and erasure of data, the right to grievance redressal, and the right to nominate another person to exercise these rights in the event of incapacity or death.
Data Protection Board and Enforcement
The Act provides for the establishment of a Data Protection Board to adjudicate complaints under the Act and impose penalties for violations. The Board can impose significant financial penalties, with the highest penalty being ₹250 crore for certain categories of violations.
Implementation Challenges
A key challenge in implementing the DPDPA is developing the technical and administrative infrastructure required to support the new framework. Industry stakeholders have raised concerns about compliance costs, particularly for smaller businesses. Legal experts have also noted that the Act’s broad exemptions for the government raise concerns about data protection in the public sector.
Source: Digital Personal Data Protection Act, 2023 | Analysis: Justice Order | June 2026
