Digital Personal Data Protection (DPDP) Act, 2023 – Overview

Published December 13, 2025

1. Purpose of the DPDP Act

The DPDP Act aims to: • Protect individuals’ personal digital data • Regulate how companies, businesses, and government bodies process such data • Ensure privacy, transparency, and accountability in data handling

2. Applicability

The Act applies to: • Personal data collected in digital form, or • Non-digital data that is later digitised • Entities operating within India • Foreign entities processing data of individuals located in India

3. What is Personal Data?

Personal data means any data about an identifiable individual, such as: • Name • Mobile number • Aadhaar/PAN • Email ID • Financial information • IP address or online identifiers

4. Key Stakeholders • Data Principal: The individual whose data is collected • Data Fiduciary: Entity that decides why and how data is processed (company, firm, app, etc.) • Data Processor: Entity processing data on behalf of the Data Fiduciary

5. Consent Framework • Consent must be free, specific, informed, and unambiguous • Consent can be withdrawn at any time • Data can be processed only for lawful purposes

6. Rights of Data Principal

Individuals have the right to: • Access their personal data • Correct or erase data • Withdraw consent • Grievance redressal • Nominate another person in case of death/incapacity

7. Obligations of Businesses

Businesses must: • Collect data only for lawful purposes • Use data only