+91 85277 09690Enrol

Digital Personal Data Protection Act, 2023

India's first general data protection law. It binds anyone who decides how digital personal data is processed, and it reaches forensic laboratories because evidence copies and case files are full of other people's data.

ActParliament of India2023Phased commencementReviewed 2 November 2026
Digital Personal Data Protection Act, 2023, DFRTI

The Digital Personal Data Protection Act, 2023 is Act 22 of 2023. Parliament passed it in August 2023, the President gave assent on 11 August 2023 and it was published in the Gazette of India the same day. It is a short Act of 44 sections and one Schedule, written in plain language with illustrations, and it is the first Indian statute that deals with personal data as a subject in its own right rather than as a corner of the Information Technology Act, 2000.

Section 3 says what the Act reaches. It applies to the processing of digital personal data within India, whether the data was collected in digital form or on paper and digitised later, and to processing outside India that is connected with offering goods or services to people in India. It does not apply to data a person processes for personal or domestic purposes, nor to personal data that the individual concerned has made publicly available or that another person is obliged by law to make public.

This page is an educational summary written for examiners, laboratory managers and students. It is not legal advice. The Act is still being brought into force in stages, so the position on any given day depends on the commencement notification described below.

How the Act Is Being Brought into Force

Section 1(2) lets the Central Government appoint different dates for different provisions. It did so by notification G.S.R. 843(E) dated 13 November 2025, published in the Gazette of India on 14 November 2025. The three stages below are taken from that notification. The one-year and eighteen-month periods run from the date of publication.

  1. 01
    On Publication, 14 November 2025

    Section 1(2) itself, the definitions in section 2, sections 18 to 26 which establish the Data Protection Board of India and deal with its members and staff, section 35 on protection of action taken in good faith and sections 38 to 43 covering bar of jurisdiction, consistency with other laws, the rule-making power, laying before Parliament and removal of difficulties. Sub-sections (1) and (3) of section 44, which amend the Telecom Regulatory Authority of India Act, 1997 and the Right to Information Act, 2005, commenced the same day. Separate notifications of the same date established the Board under section 18.

  2. 02
    One Year After Publication

    Section 6(9), which requires every Consent Manager to be registered with the Board, and section 27(1)(d), the Board's power to inquire into a breach of the conditions of a Consent Manager's registration. These match Rule 4 of the Rules, which commences on the same day.

  3. 03
    Eighteen Months After Publication

    Everything an ordinary organisation will feel: sections 3 to 5, section 6 except sub-section (9), sections 7 to 17 covering legitimate uses, duties of Data Fiduciaries, children, Significant Data Fiduciaries, the rights and duties of Data Principals, cross-border transfer and the exemptions, section 27 except clause (1)(d), sections 28 to 34 on the Board's inquiries, appeals, mediation, undertakings and penalties, sections 36 and 37 and section 44(2), which amends the Information Technology Act, 2000. Until that day the substantive duties and the penalties are not in force.

Terms the Act Uses

All of these are defined in section 2. The Act uses the pronouns she and her for every person, whatever their gender.

C
Consent Manager
A person registered with the Board who acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent on an accessible, transparent and interoperable platform.
D
Data Fiduciary
Any person who, alone or with others, determines the purpose and means of processing personal data. The duties and the penalties in the Act fall on the Data Fiduciary, not on its vendors.
Data Principal
The individual the personal data is about. For a child it includes the parents or lawful guardian, and for a person with disability it includes the lawful guardian acting on her behalf.
Data Processor
Any person who processes personal data on behalf of a Data Fiduciary. A cloud host, a payroll firm or a laboratory engaged by a company to examine its own devices can be one. Section 8(2) requires a valid contract.
Data Protection Board of India
The body established under section 18 that receives breach intimations, inquires into complaints, issues directions and imposes penalties. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal under section 29.
P
Personal Data
Any data about an individual who is identifiable by or in relation to that data. The Act does not create a separate category of sensitive personal data; the same duties apply to all of it.
Personal Data Breach
Any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability. A lost evidence drive is a breach on this definition.
S
Significant Data Fiduciary
A Data Fiduciary or class the Central Government notifies under section 10 after weighing the volume and sensitivity of data, risk to individuals, sovereignty, electoral democracy, security of the State and public order. It must appoint a Data Protection Officer based in India, an independent data auditor and carry out periodic Data Protection Impact Assessments.

What the Act Requires

A summary of Chapter II and Chapter III. Each of these commences eighteen months after 14 November 2025 unless a later notification changes the date.

  • Personal data may be processed only for a lawful purpose, either with the Data Principal's consent or for one of the legitimate uses listed in section 7, such as a purpose for which she voluntarily gave the data, employment, medical emergencies or State benefits (section 4).
  • A request for consent must be preceded or accompanied by a notice stating the personal data, the purpose, how to withdraw consent and how to complain to the Board (section 5). Consent must be free, specific, informed, unconditional and unambiguous (section 6).
  • A Data Fiduciary remains responsible for processing done by its Data Processors, must keep data complete and accurate where it drives decisions, must take reasonable security safeguards and must erase personal data once consent is withdrawn or the purpose is served, unless another law requires retention (section 8).
  • On a personal data breach the Data Fiduciary must inform the Board and each affected Data Principal in the form and manner prescribed by the Rules (section 8(6)).
  • Processing a child's data needs verifiable consent of a parent or guardian, and tracking, behavioural monitoring and targeted advertising directed at children are barred (section 9).
  • Data Principals have rights to access information about processing, to correction and erasure, to grievance redressal and to nominate someone to act for them (sections 11 to 14), and duties not to impersonate or file false complaints (section 15).
  • The Central Government may restrict transfer of personal data to notified countries (section 16).

How It Touches Forensic Work and a Laboratory

A forensic laboratory holds personal data of two kinds. The first is ordinary: client contacts, staff files, student records. The second is unusual: forensic images, extracted phone data and exported mailboxes containing the personal data of suspects, victims, witnesses and bystanders who never dealt with the laboratory at all. Both are digital personal data under section 2.

Section 17(1) is where the examiner's work meets the Act. Most of Chapter II, all of Chapter III and section 16 do not apply where processing is necessary to enforce a legal right or claim, where a court or a body with judicial, quasi-judicial, regulatory or supervisory functions is processing for that function or where personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of law. The exemption is not total. Section 17(1) expressly keeps section 8(1), which makes the Data Fiduciary responsible for compliance, and section 8(5), the duty to take reasonable security safeguards, in force even inside the exemption. A laboratory therefore cannot treat an evidence image as outside the Act; it can at most treat the consent, notice and rights provisions as not applying to it, and it should ask counsel how far that reaches a private laboratory working for a corporate client as against a police forensic unit.

Section 17(2)(a) goes further for instrumentalities of the State notified in the interests of sovereignty, security, public order and related grounds, and section 17(2)(b) exempts processing for research, archiving and statistics carried out to prescribed standards. A training institute running exercises on synthetic data sets is not processing personal data at all, which is one more reason to build teaching material that way.

  • Treat evidence images and extractions as personal data in security and retention planning
  • Record which exemption in section 17 the laboratory relies on for each kind of work
  • Keep section 8(5) safeguards whether or not an exemption applies
  • Put Data Processor terms into engagement letters where the client is the Data Fiduciary

Penalties and Enforcement

Section 33 lets the Board impose the monetary penalties in the Schedule after an inquiry and a hearing, having regard to the nature, gravity and duration of the breach, the data affected, repetition, gain or loss and mitigation.

  • Security Safeguards

    Failure to take reasonable security safeguards under section 8(5): up to two hundred and fifty crore rupees.

  • Breach Notification

    Failure to notify the Board or affected Data Principals of a personal data breach under section 8(6): up to two hundred crore rupees.

  • Children and Significant Fiduciaries

    Breach of the additional duties relating to children under section 9: up to two hundred crore rupees. Breach of the duties of a Significant Data Fiduciary under section 10: up to one hundred and fifty crore rupees.

  • Everything Else

    Breach of any other provision of the Act or the Rules: up to fifty crore rupees. A Data Principal who breaches her duties under section 15: up to ten thousand rupees.

What the Act Does Not Do, and Common Misunderstandings

  • It does not apply to non-digital personal data that is never digitised, and it does not apply to data an individual has made public herself.
  • It is not yet fully in force. Reading news that the Act was notified in November 2025 is true, but the duties and penalties commence eighteen months later. Check the current notification before advising anyone.
  • It does not define sensitive personal data, data localisation across the board or a right to data portability. Some of what readers expect from the European regulation is simply not here.
  • It does not make a forensic examination lawful or unlawful. Authority to examine a device comes from the criminal procedure law, a court order, a contract or the owner's consent. The Act governs what happens to the personal data afterwards.
  • It does not replace the Information Technology Act, 2000. Section 44(2) will omit section 43A and amend sections 81 and 87 of that Act when it commences; the rest of the IT Act continues.
  • Following ISO/IEC 27001 or any other standard does not make an organisation compliant with this Act. Compliance is a question of what was done and recorded, judged against the sections.

Common Questions

Is the DPDP Act in force today?

Partly. Since 14 November 2025 the definitions, the Board provisions and the rule-making power are in force. The duties on Data Fiduciaries, the rights of Data Principals and the penalties commence eighteen months after that date, and the Consent Manager registration provisions one year after it. The Act itself says the commencement of a provision means the date it is brought into force.

Does the investigation exemption cover a private digital forensics laboratory?

Section 17(1)(c) exempts processing in the interest of prevention, detection, investigation or prosecution of any offence or contravention of law. It does not say who may rely on it, and it keeps the security safeguard duty alive in any case. Whether a particular private engagement falls within it is a question for counsel on the facts, not something to assume.

Is a lost evidence drive a personal data breach?

On the section 2 definition, loss of access to personal data that compromises its availability or confidentiality is a breach. Once section 8(6) commences, the Board and the affected individuals must be told in the manner the Rules prescribe. A laboratory's own chain-of-custody discipline is the best protection against ever having to make that call.

Where does an appeal against the Board go?

To the Telecom Disputes Settlement and Appellate Tribunal, which the Act names as the Appellate Tribunal in section 2(a) and section 29.

Official sources

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Disciplines where this applies

Courses that teach it

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.

Explore the AcademyAbout membershipTalk to a counsellor