A law for digital personal data
The Digital Personal Data Protection Act, 2023 is Act No. 22 of 2023. The President assented on 11 August 2023. It governs how digital personal data is processed, recognising both a person's right to protect her data and the need to process it for lawful purposes.
The Act has 44 sections and one Schedule of penalties. The detail sits in the Digital Personal Data Protection Rules, 2025, notified by MeitY as G.S.R. 846(E) on 13 November 2025. Most of the Act and Rules are not yet in force; lesson 12 gives the dates.
Sources: Act preambleAct s.1
Personal data and processing
Personal data is any data about an individual who is identifiable by or in relation to that data. Digital personal data is personal data in digital form. Processing is any wholly or partly automated operation on it, from collection and storage to use, sharing and erasure.
Sources: Act s.2(t)Act s.2(n)Act s.2(x)
Where the Act applies
Inside India, the Act applies to digital personal data collected in digital form, and to data collected on paper and digitised later. Outside India, it applies when processing is connected to offering goods or services to people in India, such as a foreign app with Indian users.
Two things are outside it. The first is data an individual processes for a personal or domestic purpose. The second is personal data made public by the person it relates to, or by someone legally required to publish it. The Act's own example is a blogger who shares her details on social media.
Sources: Act s.3
Exemptions, at a high level
Section 17(1) switches off most duties for listed cases. They are: enforcing legal rights or claims, courts and regulators doing their functions, preventing or investigating offences, approved mergers, and tracing a loan defaulter's assets. Even then, the Fiduciary stays responsible for compliance and must keep reasonable security safeguards.
The Government may also notify State bodies for security and public order, and certain Fiduciaries, including startups, to be excused from some duties. Research, archiving and statistics are exempt only if no decision about a specific person is taken and the Second Schedule standards are met.
Sources: Act s.17Rules r.16
How it sits with other laws
The Act adds to other Indian laws rather than replacing them. If a provision truly conflicts with another law, the DPDP provision prevails to that extent. When section 44(2) starts, around May 2027, it omits section 43A of the Information Technology Act, 2000.
Sources: Act s.38Act s.44(2)G.S.R. 843(E)
Key points
- Covers digital personal data, including paper records digitised later.
- Reaches foreign firms offering goods or services to people in India.
- Personal or domestic use and lawfully public data fall outside.
- Exempt processing still needs security safeguards and accountability.
- Adds to other laws; prevails only in a real conflict.
In practice
A checklist for your organisation.
- List every system holding personal data, including scanned paper files.
- Check whether group companies abroad serve people in India.
- Record any section 17 exemption you rely on, with its reason.
- Keep security controls in place even for exempt processing.
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
A company scans old paper application forms into its document system. Does the Act apply to the scanned data?
Show the answer
B. Yes, data collected on paper and digitised later is covered
Section 3(a)(ii) applies the Act to personal data collected in non-digital form and digitised subsequently.
Act s.3(a)Section 3(a)(ii) applies the Act to personal data collected in non-digital form and digitised subsequently.
Act s.3(a)Question 2 of 5
A company based abroad offers an app to users in India. When does the Act reach its processing outside India?
Show the answer
B. When the processing is connected to offering goods or services to people in India
Section 3(b) extends the Act to processing outside India connected to offering goods or services to Data Principals in India.
Act s.3(b)Section 3(b) extends the Act to processing outside India connected to offering goods or services to Data Principals in India.
Act s.3(b)Question 3 of 5
Which of these is outside the Act?
Show the answer
D. An individual keeping contacts for a personal or domestic purpose
Section 3(c)(i) excludes personal data processed by an individual for any personal or domestic purpose.
Act s.3(c)Section 3(c)(i) excludes personal data processed by an individual for any personal or domestic purpose.
Act s.3(c)Question 4 of 5
Under section 17(1), which duties still apply to processing that is otherwise exempt?
Show the answer
C. Overall responsibility and reasonable security safeguards (s.8(1) and s.8(5))
Section 17(1) switches off Chapter II except sub-sections (1) and (5) of section 8: responsibility for compliance and reasonable security safeguards.
Act s.17(1)Section 17(1) switches off Chapter II except sub-sections (1) and (5) of section 8: responsibility for compliance and reasonable security safeguards.
Act s.17(1)Question 5 of 5
A DPDP provision conflicts with a provision of another law. What happens?
Show the answer
C. The DPDP provision prevails to the extent of the conflict
Section 38(2) says the DPDP provision prevails to the extent of the conflict; section 38(1) otherwise keeps other laws in place.
Act s.38Section 38(2) says the DPDP provision prevails to the extent of the conflict; section 38(1) otherwise keeps other laws in place.
Act s.38
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.