Digital Personal Data Protection Act (DPDP Act)

The Digital Personal Data Protection Act (DPDP Act) is India's data-privacy law, enacted in 2023, which governs how digital personal data is processed and sets out the rights of the individuals that data belongs to. It is India's comprehensive framework for personal-data protection, giving the country a modern privacy regime comparable in ambition, though not identical in design, to other major data-protection laws. The Act uses its own vocabulary: the individual whose data is processed is the data principal, and the organization or person deciding how and why the data is processed is the data fiduciary — roughly parallel to the data subject and data controller found in other regimes. It applies to the processing of digital personal data within India, and it reaches beyond India's borders when the processing relates to offering goods or services to individuals inside the country, which gives it real relevance to businesses far outside India.

The Act's core is a set of obligations on data fiduciaries and a set of rights for data principals. Fiduciaries must generally obtain consent to process personal data, unless another lawful basis applies, and must use the data only for the purpose for which it was collected. Individuals gain rights over their data, and the Act carries additional protections for the personal data of children — including requirements for verifiable parental consent and restrictions on certain processing directed at children. Enforcement runs through the Data Protection Board of India, and the Act provides for significant financial penalties for breaches of its obligations, giving it teeth. For any business that markets to, or serves, people in India, the DPDP Act is a live compliance consideration, and this page describes it in general terms only and is not legal advice.

The DPDP Act invites comparison with the European Union's General Data Protection Regulation (GDPR), and the parallels are real but the two are not the same. Both are comprehensive personal-data laws built on consent, individual rights, and obligations on the organizations that process data, and both reach beyond their home borders to cover the handling of residents' data. But they differ in structure, terminology, and detail. The DPDP Act uses data principal and data fiduciary where GDPR uses data subject and controller; it has its own consent, children's-data, and enforcement provisions; and its scope and mechanics are tailored to India. It focuses specifically on digital personal data, whereas GDPR's reach is drawn differently. Treating the DPDP Act as simply India's copy of GDPR misreads it — the concepts rhyme, but the rules are distinct and must be complied with on their own terms.

The practical point for a global business is that these regimes stack rather than substitute. A company serving users across regions can fall under the DPDP Act for its Indian users, GDPR for its EU users, and other laws elsewhere, all at once — each with its own definitions, consent standards, rights, and penalties. Compliance with one does not confer compliance with another, even where they overlap, so a mature privacy program maps which law applies to which users and satisfies each on its own terms. The DPDP Act's extraterritorial reach means a business does not need a presence in India to be within scope; offering goods or services to people in India can be enough. As with any legal regime, the details matter and qualified counsel is required for specific situations. This page is general information, not legal advice.

For a marketer or business handling data of people in India, the DPDP Act shapes how personal data may be collected and used. Consent is central: fiduciaries generally need it to process personal data and must confine use to the stated purpose, which touches everything from sign-up flows to how collected data feeds targeting and analytics. The children's-data provisions add real constraints on processing directed at minors, including verifiable parental consent, which matters for any product or campaign that reaches young users. And because the Act reaches processing tied to offering goods or services to people in India, a business outside India can still be within scope. The practical stance is to know when Indian users are involved and to build consent and purpose-limitation into data practices rather than bolt them on.

The failure modes are assuming the Act does not apply because the business is not based in India, treating it as interchangeable with GDPR, and neglecting the specific children's-data and consent requirements. Its extraterritorial reach defeats the first assumption; its distinct definitions and rules defeat the second; and its penalties make the third costly. The discipline is to determine whether the DPDP Act applies to a given set of users, to satisfy its consent, purpose-limitation, and children's-data requirements on their own terms rather than by analogy to another law, and to get qualified legal advice for anything specific. This page is educational and general and does not constitute legal advice on any particular situation.

The Digital Personal Data Protection Act (DPDP Act) is India's 2023 data-privacy law governing the processing of digital personal data, with extraterritorial reach and its own rules distinct from GDPR.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where digital personal data protection act (dpdp act) is a core concern: