Digital Personal Data Protection: FAQs

The DPDP Act, 2023 is India's first comprehensive law dedicated to protecting personal data. It received presidential assent in August 2023. The Act sets out how organisations may collect, store, use and share the personal data of individuals in India, gives individuals a defined set of rights over their own data, and creates a regulator, the Data Protection Board of India, to hear complaints and impose penalties. Before this law, data protection in India was governed largely by the Information Technology Act, 2000 and rules made under it, which were narrower in scope and weaker in enforcement.

Three forces pushed it forward. First, the Supreme Court's 2017 judgment in Justice K.S. Puttaswamy v. Union of India held that privacy is a fundamental right under Article 21 of the Constitution, and expressly called for a data protection framework. Second, India's digital economy grew faster than the rules governing it, leaving personal data flowing through apps, platforms and services with little accountability. Third, global regimes such as the EU's GDPR set an international benchmark that Indian businesses handling foreign data were already having to meet. The Act is India's answer to all three.

The Act sets out principles; the Rules supply the operational detail. The Digital Personal Data Protection Rules were notified on 13 November 2025 and cover matters the Act left to be prescribed, including the form and content of the notice given to individuals, how Consent Managers must be registered and operate, security safeguards expected of organisations, breach notification procedure, retention limits for certain classes of business, and the functioning of the Data Protection Board. In practice, an organisation needs to read the Act and the Rules together.

It is being brought into force in stages rather than all at once. The first stage took effect on 13 November 2025, covering the establishment of the Data Protection Board of India. The Consent Manager framework follows on 13 November 2026. The substantive obligations that most organisations must comply with, including consent requirements, notice, security safeguards and breach reporting, take effect on 13 May 2027. That staged timeline is deliberate: it gives organisations a defined runway to prepare rather than a single cliff edge.

The Act applies to digital personal data. Personal data means any data about an individual who is identifiable by or in relation to that data. Digital means the data is either collected in digital form, or collected on paper and later digitised. That covers far more than most people assume: names, phone numbers and email addresses, but also a patient's diagnosis, an employee's attendance record, a customer's transaction history, a photograph, a voice recording, an IP address tied to an account, and location data.

Four main things. Data that is not personal at all, such as aggregated or genuinely anonymised statistics. Personal data processed by an individual purely for personal or domestic purposes, so your own phone contacts are not covered. Personal data that the individual has themselves made publicly available, or that someone is legally obliged to publish. And data processed for research, archiving or statistical purposes, subject to prescribed standards. The Act also allows the Central Government to exempt certain State instrumentalities on specified grounds.

Yes, in defined circumstances. The Act applies to processing of digital personal data within India, and also to processing outside India where it relates to offering goods or services to individuals within India. So a foreign company with Indian users generally falls within scope. It does not apply to personal data of individuals outside India that is processed in India purely under a contract with a foreign entity, which protects India's outsourcing and IT services sector.

The old framework, chiefly the SPDI Rules made under Section 43A of the Information Technology Act, 2000, was narrower. It applied mainly to bodies corporate, focused on a defined list of sensitive personal data such as passwords, financial and health information, and had limited enforcement in practice. The DPDP Act covers all digital personal data rather than a sensitive subset, applies to a wider range of entities including the State in many respects, grants individuals enforceable rights, and creates a dedicated regulator with substantial penalty powers.

The Data Principal is the individual the personal data is about. If you are a customer, a patient, an employee, a client or a website user, you are a Data Principal in relation to the data held about you. Where the individual is a child, the Data Principal includes the parent or lawful guardian. Where the individual is a person with disability who has a lawful guardian, it includes that guardian. Data Principals hold the rights under the Act; they do not carry the compliance burden.

A Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. The word fiduciary is deliberate: it signals a relationship of trust rather than mere possession. A hospital deciding how patient records are used, an employer deciding how staff data is handled, a retailer deciding what customer data to collect, and a law firm deciding how client information is stored are all Data Fiduciaries. The obligations under the Act rest primarily on them.

A Data Processor processes personal data on behalf of a Data Fiduciary, under that Fiduciary's instructions. Cloud hosting providers, payroll bureaus, analytics vendors, diagnostic laboratories acting for a hospital and outsourced customer support teams are typical examples. Processors act within the scope of their contract. Critically, engaging a Processor does not transfer responsibility: the Data Fiduciary remains accountable to the Data Principal and to the Board for what its Processors do.

A Significant Data Fiduciary, or SDF, is a Data Fiduciary or class of Fiduciaries notified as such by the Central Government. The assessment considers factors including the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential effect on the sovereignty and integrity of India, risks to electoral democracy, security of the State, and public order. SDFs carry additional obligations beyond those applying to ordinary Data Fiduciaries.

Yes, and this is common. The role depends on the activity, not the entity. A logistics firm is a Data Processor when it handles delivery addresses on a retailer's instructions, but a Data Fiduciary for its own employee records and its own direct customers. A marketing agency is a Processor for campaign data it runs on a client's behalf, and a Fiduciary for its own contact database. A manufacturer is a Fiduciary for its dealer network data and a Processor when handling warranty data for a brand it supplies. The practical step is to map roles activity by activity rather than assuming one label describes the whole organisation.

Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and it must signify agreement to processing for the specified purpose only. Consent is limited to the data necessary for that stated purpose. Pre-ticked boxes, silence, inactivity and consent buried in lengthy terms and conditions do not meet the standard. Any part of a consent that infringes the Act or the Rules is invalid to that extent.

The notice must be clear, standalone and in plain language, and must be available in English or any language in the Eighth Schedule to the Constitution at the individual's choice. It must describe the personal data being collected and the purpose of processing, explain how the individual can exercise their rights, how consent can be withdrawn, and how to complain to the Data Protection Board. Good practice, reflected consistently across sector guidance, is to itemise the notice: what categories of data are collected, each purpose, where the data is stored and for how long, which third parties it is shared with, and the withdrawal and grievance routes. A notice that requires the reader to hunt for any of these is unlikely to support valid consent.

No. Consent must be specific to a stated purpose, and it must be capable of being given and withdrawn independently. Bundling it into onboarding paperwork, invoices, employment contracts, service agreements or blanket terms and conditions undermines both the specificity and the freedom of the consent. A signature on a form that serves some other primary purpose is not consent to unrelated processing. Where an organisation processes data for several distinct purposes, each should be separately presented so an individual can agree to one without being forced to accept all.

Yes. A Data Principal has the right to withdraw consent at any time, and the Act requires that withdrawing be as easy as giving it. Withdrawal does not invalidate processing that lawfully took place before it. Once consent is withdrawn, the Data Fiduciary must stop processing and must cause its Processors to stop as well, and should erase the personal data unless retention is required for a legal purpose. Practically, this means withdrawal has to propagate through your systems and your vendors, not merely set a flag in a database.

A Consent Manager is an entity registered with the Data Protection Board that acts as a single accessible point through which a Data Principal can give, manage, review and withdraw consent across multiple Data Fiduciaries. The idea is to relieve individuals from managing dozens of separate consent settings across dozens of services. Consent Managers must be registered with the Board and meet prescribed technical and organisational conditions. This part of the framework comes into force on 13 November 2026.

Consent is the primary basis, but the Act also recognises certain legitimate uses. These include situations where an individual voluntarily provides data for a specified purpose and has not indicated objection, performance of State functions and provision of subsidies, benefits, services, certificates, licences or permits, compliance with law or court orders, responding to medical emergencies and threats to life, providing medical treatment or health services during an epidemic or public health threat, ensuring safety during disasters or breakdowns of public order, and specified employment purposes. These are defined categories, not a general escape route.

The Act applies to data already held. Where processing continues on the basis of consent obtained earlier, the Data Fiduciary must give the individual a fresh notice, as soon as reasonably practicable, containing the prescribed information, and processing may continue until the individual withdraws consent. In practical terms this means legacy databases need review: consent obtained years ago for a vaguely described purpose may not support what an organisation now wants to do with the data, and where it does not, deletion is often cheaper than justification.

Five, broadly. The right to access information about your data, meaning a summary of the personal data being processed, the processing activities, and the identities of other Fiduciaries and Processors with whom it has been shared. The right to correction, completion, updating and erasure. The right to grievance redressal through the Data Fiduciary's own mechanism. The right to nominate another individual to exercise your rights in the event of death or incapacity. And the right to withdraw consent at any time.

You approach the Data Fiduciary first, using the means it has published for this purpose. Every Data Fiduciary must publish the contact details of a Data Protection Officer or another person able to answer questions about processing. If you are not satisfied with the response, or receive none, you may then complain to the Data Protection Board of India. The Act expects individuals to exhaust the Fiduciary's own grievance mechanism before escalating.

It lets you nominate another individual who can exercise your rights under the Act on your behalf if you die or become incapable of exercising them yourself, for example through unsoundness of mind or infirmity of body. It is a practical provision that addresses a real gap: without it, personal data held by a service provider can become effectively frozen when the individual concerned is no longer able to act.

Escalate to the Data Protection Board of India, which is the adjudicating body created under Section 18 of the Act. The Board can inquire into complaints, direct remedial measures and impose monetary penalties. Note that the Act also places duties on Data Principals: complaints must be genuine, and furnishing false particulars or filing frivolous complaints can itself attract a penalty. The remedy is real, but it is meant for genuine grievances.

In outline: process personal data only for a lawful purpose with consent or a recognised legitimate use; give a clear notice before or at the time of seeking consent; collect only what is necessary for the stated purpose; ensure the data is accurate and complete where it may be used to make a decision affecting the individual or shared with another Fiduciary; put in place reasonable security safeguards; report breaches to the Board and to affected individuals; erase data when the purpose is no longer served and retention is not legally required; publish contact details for handling queries; and maintain an effective grievance redressal mechanism.

Three main additions. An SDF must appoint a Data Protection Officer who is based in India and reports to the board of directors or equivalent governing body, and who serves as the point of contact for grievance redressal. It must appoint an independent data auditor to evaluate compliance. And it must undertake periodic Data Protection Impact Assessments and periodic audits, along with any other measures the Government prescribes, which may include restrictions on transferring certain personal data outside India.

The Data Fiduciary must notify the Data Protection Board and each affected Data Principal, in the form and manner prescribed. The obligation is not limited to large or malicious breaches: any personal data breach, meaning unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability, falls within it. Note that separate reporting duties may run in parallel. All regulators impose their own incident reporting timelines. Organisations should have a documented incident response plan that accounts for every reporting obligation that applies to them, not just the DPDP one.

Generally yes, subject to restriction. The Act permits transfer of personal data outside India except to countries or territories that the Central Government restricts by notification. This is a negative list approach rather than the adequacy model used in some jurisdictions, and it is more permissive than earlier draft bills. However, and this catches organisations out, sectoral localisation requirements continue to operate independently of the Act and are often stricter. Payment system data must be stored in India under RBI requirements, and securities, insurance and telecom regulators impose their own record location and localisation conditions. Health sector guidance similarly discourages transferring health data abroad. The DPDP position is the floor, not the ceiling.

Only as long as the purpose it was collected for continues to be served, unless retention is required by law. Once the purpose is spent and no legal retention obligation applies, the Data Fiduciary must erase the data and cause its Processors to do so. The Rules prescribe specific retention limits for certain classes of Data Fiduciary above defined user thresholds, after which data must be erased following notice to the individual. In practice, many sectors carry minimum retention obligations that pull the other way: anti money laundering and KYC rules require financial records to be kept for years, tax and company law impose their own periods, and securities, insurance and health regulators each set retention floors. Where a statutory retention duty applies, it generally prevails over an erasure request, and organisations should be able to point to the specific provision they are relying on.

Strictly. A child means anyone under 18, with no graduated age scale, which is stricter than the GDPR's range of 13 to 16 depending on member state. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited. Processing that is likely to cause any detrimental effect on the wellbeing of a child is also prohibited. Limited exemptions may be prescribed for specified purposes such as healthcare and education.

Yes. Employees are Data Principals with the same rights as anyone else, and the employment relationship does not by itself supply consent. The Act does recognise certain employment purposes as legitimate uses, covering matters such as safeguarding the employer from loss or liability, prevention of corporate espionage, protection of intellectual property and trade secrets, and provision of services or benefits to employees. That is a defined category, not a blanket permission. Excessive monitoring, profiling of employees' private lives and collection beyond what the stated purpose requires remain exposed.

Health data attracts the same statutory obligations as any other personal data under the Act, with additional sector layers. NABH has issued a Guidance on the Digital Personal Data Protection Act, 2023 applying to accredited hospitals, HIS, EMR and CMS providers and third party systems handling health data, covering consent management, data lifecycle controls, retention, breach response and vendor contracts. Separately, the CDSCO's Guidance Document on Medical Device Software, issued on 21 July 2026, brings AI enabled medical software within the Medical Devices Rules, 2017 and requires disclosure of the datasets used to train, validate and test such software. Organisations in other sectors should note the pattern rather than the detail: your own regulator may well have issued something equivalent.

Only on the same footing as any other processing, which is harder than it sounds. Training is a purpose in its own right, so it requires consent for that purpose or a recognised legitimate use. Data collected to deliver a service cannot simply be repurposed to train a model without fresh, specific consent. The exemption for data voluntarily made public is narrower than it appears: material scraped broadly from the internet was rarely made public for the purpose of AI training. The point applies with particular force to vendor relationships. A recurring principle across sector guidance is that third parties must not replicate, monetise or make secondary use of personal data without independent consent, and feeding a client's data into a vendor's model to improve that model is secondary use.

This is the most honest gap in the framework. Withdrawal stops further processing and should trigger erasure of the underlying records. But a trained model does not store records the way a database does; the information is absorbed into statistical weights from which one person's contribution generally cannot be cleanly extracted without retraining the model. Machine unlearning is an active research field rather than a settled compliance solution. MeitY's India AI Governance Guidelines acknowledge that consent and purpose limitation need greater clarity as applied to AI. Until that arrives, the practical answer is to minimise what enters training in the first place.

The Board is the adjudicating body established under Section 18 of the Act. It inquires into personal data breaches and complaints, directs urgent remedial or mitigation measures, and imposes monetary penalties. It functions as a digital office, with proceedings conducted digitally, and it has the powers of a civil court for matters such as summoning witnesses and requiring production of documents. Its orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal. The Board's leadership was appointed during 2026, following the framework coming into force in November 2025.

The Schedule to the Act sets graded penalties, with a ceiling of ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Failure to notify a breach to the Board or affected individuals attracts up to ₹200 crore, as does breach of obligations relating to children's data. Failure of a Significant Data Fiduciary to meet its additional obligations attracts up to ₹150 crore. Breach of a Data Principal's own duties attracts up to ₹10,000. The Board considers factors including the nature, gravity and duration of the breach when determining the amount.

The Act does not provide a statutory compensation mechanism for individuals. Penalties imposed by the Data Protection Board are payable to the Consolidated Fund of India, not to the affected individual. That does not leave you without remedy: separate claims may be available under other law, including civil action, and in appropriate cases criminal provisions such as Section 66C of the Information Technology Act, 2000, which addresses fraudulent use of another person's unique identification feature. Those are distinct routes from a complaint to the Board.

Yes, and this is one of the most commonly missed points. The DPDP Act sets a baseline that applies across every sector, but it does not repeal or override the data and cybersecurity rules that individual regulators already enforce. Those continue to operate alongside it, and are frequently stricter.

In financial services, the RBI issued Advisory No. 3/2026 dated 25 March 2026, through its Department of Supervision, on best practices for customer data protection, drawing on a thematic study across supervised entities. It sits on top of existing RBI frameworks including the Master Directions on IT Governance, the Digital Lending Guidelines and payment data localisation requirements. In healthcare, NABH and the CDSCO have issued the guidance described elsewhere in these FAQs.

The practical consequence is that compliance is rarely a single exercise. An organisation needs to know both what the Act requires and what its own regulator requires, and to reconcile the two where they pull in different directions, most often on retention and breach reporting timelines.

The primary legislation and the main sector guidance referenced in these FAQs are listed below.

The Digital Personal Data Protection Act, 2023.

The Digital Personal Data Protection Rules, 2025.

NABH Guidance on the Digital Personal Data Protection Act, 2023

The CDSCO Guidance Document on Medical Device Software.

RBI Advisory No. 3/2026 dated 25 March 2026.

Readers should always work from the official published version of any document, since guidance in this area is being updated frequently.