The Digital Personal Data Protection Act, 2023 is India's law on digital personal data. It sets duties for organisations that handle it and gives individuals rights over their data.
The Act covers personal data in digital form, including data collected offline and then digitised. Organisations that decide why and how data is used are called Data Fiduciaries. The people the data is about are called Data Principals.
If you handle digital personal data of people in India, it most likely does, whatever your size or sector. It can also apply to organisations abroad that offer goods or services to people in India.
The Act has limited exemptions, and the government can set some by notification. Whether one applies to you is a question for your legal counsel. Our gap assessment records the facts they need.
A Data Fiduciary decides why and how personal data is used. A Data Processor handles data on a fiduciary's behalf. The fiduciary carries the main duties.
A fiduciary stays responsible for its processors, so the contract between them matters. The same organisation can be a fiduciary for some data and a processor for other data.
Before collecting data, you give a clear notice of what you collect and why. Consent must be free, specific and informed, and people must be able to withdraw it as easily as they gave it.
The notice also tells people how to exercise their rights and how to complain to the Board. The Act allows some uses of data without consent. We map each of your uses to its basis.
People can ask for a summary of their data, correct or erase it, raise a grievance, and nominate someone to act for them.
You need a route for people to make these requests and a way to track each one until it is closed. Erasure may be limited where another law requires you to keep the data.
Start by mapping what personal data you hold and why. Then fix notices and consent, set up rights requests, and review your vendors.
A short readiness check on the DPDPA page shows where you stand across five areas. A gap assessment then turns that into a ranked plan.
Decides why and how personal data is used.
The person the data is about.
Handles data on a fiduciary's behalf.
A registered service that lets people give and manage consent.
A fiduciary the government names for extra duties.
| DPDPA | CERT-In Directions | |
|---|---|---|
| What triggers it | A personal data breach | A cyber security incident |
| Who is told | Data Protection Board and affected people | CERT-In |