Maarg Manthan · Topic 16.2

The Digital Personal Data Protection Act, 2023

Current Affairs & Government Schemes › Recently Enacted Acts, Bills and Amendments · Topic 16.2

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first full law on the processing of digital personal data, enacted by Parliament and given assent on 11 August 2023, and administered by the Ministry of Electronics and Information Technology. It rests on consent and lawful use, gives individuals, called Data Principals, rights to access, correct and erase data, and puts duties on organisations, called Data Fiduciaries. It creates a Data Protection Board of India and allows penalties of up to 250 crore rupees. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and bring the law into force in phases over about 18 months.

6 min read · UPSC Prelims · Current Affairs & Government Schemes · Recently Enacted Acts, Bills and Amendments

At a Glance

Act Digital Personal Data Protection Act, 2023
Assent 11 August 2023
Ministry Electronics and Information Technology
Regulator Data Protection Board of India
Maximum penalty 250 crore rupees
Rules DPDP Rules, 2025, notified November 2025, phased
Exam link UPSC Prelims, Current Affairs and Government Schemes: Recently Enacted Acts, Bills and Amendments

Where Does It Fit?

This topic covers the privacy law that follows the digital programmes of the earlier macros. It rests on the constitutional right to privacy and is followed by the new criminal laws. Previous topic: The Three Farm Laws and Their Repeal (2020–21). Next topic: The Bharatiya Nyaya Sanhita, Bharatiya Nagarik Suraksha Sanhita and Bharatiya Sakshya Adhiniyam (Replacing IPC, CrPC, Evidence Act).

What Are the Key Features of the DPDP Act?

Feature	Details
Scope	Digital personal data collected in India, and digitised data, and processing outside India linked to offering goods or services in India
Consent	Processing needs free, specific, informed and unambiguous consent through a clear notice, and consent can be withdrawn. Consent managers help people manage consent
Legitimate uses	Data may be processed without consent for listed uses, such as State benefits and services, legal duties, medical emergencies, disasters and employment
Rights of Data Principal	Right to information, correction and erasure, grievance redress and to nominate a person for death or incapacity
Duties of Data Fiduciary	Purpose limitation, data minimisation, security safeguards, breach intimation, erasure after purpose is served
Children	Verifiable consent of a parent or guardian for those under 18, and no tracking or targeted advertising directed at children, with some exemptions

How Is the Law Enforced and What Are the Concerns?

Data Protection Board of India: an adjudicating body that hears complaints, orders remedies and imposes penalties, with proceedings held digitally under the Rules
Appeals: appeals against Board decisions go to the Telecom Disputes Settlement and Appellate Tribunal
Penalties: up to 250 crore rupees for failure of security safeguards, with other tiers for breach notice failure and for breaches of children’s data duties, and a small penalty for misuse of rights by a Data Principal
Significant Data Fiduciary: a larger or riskier entity can be notified for extra duties such as an audit, impact assessment and a data protection officer
Cross-border transfer: allowed except to countries restricted by the Central Government
Rules of 2025: the Digital Personal Data Protection Rules, 2025 were notified in November 2025, with the Board provisions effective at once, consent manager provisions after about a year and most duties after about 18 months, around May 2027, as reported
Exemptions: wide exemptions for the State on grounds such as security, sovereignty and public order, which critics say weaken the right
RTI amendment: the Act changes the privacy exemption in the Right to Information Act, 2005, and critics fear it will reduce transparency

What Else Should You Remember?

Constitutional base: the Supreme Court in Justice K. S. Puttaswamy v Union of India, 2017, held that privacy is a fundamental right under Article 21
Earlier bills: a draft Bill of 2018 from the Srikrishna Committee, then the Personal Data Protection Bill, 2019, which went to a joint committee and was withdrawn in August 2022, and a new draft in November 2022 that led to the 2023 Act
Link to Aadhaar: the Aadhaar framework is separate, as in Aadhaar-Enabled Services and the Aadhaar Act
Link to digital public goods: UPI and the data layer of India Stack work with consent, as in India Stack and Open Network for Digital Commerce (ONDC)
Link to Digital India: the law provides a trust framework for the Digital India programme, as in Digital India Programme
International comparison: the European Union General Data Protection Regulation of 2018 is more detailed and has higher penalties
No data localisation: the Act does not require all data to be stored in India, unlike earlier drafts
Criticism: no right to data portability and no right to be forgotten in the broad sense, weak independence of the Board, whose members are appointed by the Government, and a lack of harm-based rules
Compliance challenge: small firms and startups need to build consent and security systems in the phase period
Way forward: strengthen Board independence, narrow State exemptions, publish clear guidance, and raise public awareness of rights

Why Does It Matter for the Exam?

Terms: Data Principal, Data Fiduciary, consent manager
Body and appeals: Data Protection Board of India and TDSAT
Penalty: up to 250 crore rupees
Dates: assent 11 August 2023; Rules November 2025; phased over about 18 months
Common errors: using EU terms such as Data Controller or saying the Board is under the Ministry of Law

As an analytical point, the law balances privacy and innovation by using consent and lawful-use grounds, but wide State exemptions and a Government-appointed Board raise doubts on independence. Public trust will depend on how the Rules and the Board work in practice.

Why Is This Topic Important?

Prelims Terms, Board and penalties are common
Mains Privacy, digital economy and State power
Linkage Joins Article 21, RTI and Digital India

What Came Next?

The next topic covers the three new criminal law codes. Next topic: The Bharatiya Nyaya Sanhita, Bharatiya Nagarik Suraksha Sanhita and Bharatiya Sakshya Adhiniyam (Replacing IPC, CrPC, Evidence Act).

Key People and Terms

Data Principal Person whose data it is
Data Fiduciary Entity that decides how data is used
Consent manager Registered entity managing consent
Significant Data Fiduciary Notified high-risk entity
Data Protection Board Adjudicating body
TDSAT Appeal tribunal

Exam Corner

Points to Remember

Assent 11 August 2023; Rules November 2025.
Terms: Data Principal and Data Fiduciary.
Penalty up to 250 crore rupees.
Appeals go to TDSAT.
Basis: Puttaswamy (2017), Article 21.

Do Not Confuse With

DPDP Act and Aadhaar Act A personal data law versus an identity law
Data Fiduciary and Data Controller Indian term versus EU term
DPDP Act and Information Technology Act, 2000 Personal data law versus the general cyber law

Memory Hook

Principal gives consent, fiduciary keeps faith, Board judges, TDSAT hears appeals.

Mains Angle

Questions ask about privacy law design. These points give a balanced frame.

Strengths Consent, rights, penalties
Weaknesses State exemptions and Board independence
Way forward Guidance and safeguards

A Question You May Face

An original practice question, not a past paper question.

“Evaluate the Digital Personal Data Protection Act, 2023 in balancing individual privacy and State and business needs.”

How to Answer

Intro Explain the Act and Puttaswamy base.
Merits Consent, rights, penalties.
Concerns Exemptions, Board, RTI change.
Way Independence and clear rules.

GS Relevance

Prelims: key terms, Board, penalties, rules, privacy judgment. GS Paper 2: governance, rights, privacy; GS Paper 3: cyber security, digital economy.

Frequently Asked Questions

What is the Digital Personal Data Protection Act, 2023?

The DPDP Act, 2023 is India's law on processing digital personal data, given assent on 11 August 2023. It uses consent and lawful use, gives rights to Data Principals, puts duties on Data Fiduciaries and sets up the Data Protection Board of India.

Which ministry administers the DPDP Act?

The Ministry of Electronics and Information Technology administers the Act and framed the Digital Personal Data Protection Rules, 2025. The Data Protection Board of India is the adjudicating body, and appeals against its decisions lie with the Telecom Disputes Settlement and Appellate Tribunal.

What rights do people get under the DPDP Act?

A Data Principal has the right to information about processing, to correction and erasure of data, to grievance redress and to nominate another person to exercise rights on death or incapacity. Consent can be withdrawn, and consent managers can help manage it.

What is the maximum penalty under the DPDP Act?

The maximum penalty is 250 crore rupees, imposed for failure to maintain reasonable security safeguards against a breach. Lower tiers apply to failure to notify a breach, breach of duties on children's data and other violations, and the Board decides the amount after an inquiry.

What is the latest status of the DPDP Act?

The Rules were notified in November 2025 and apply in phases. Board provisions took effect at once, consent manager provisions follow after about 12 months, around November 2026, and most duties about 18 months later, around May 2027, as reported, so MeitY notifications should be checked.

PYQ Practice — Statement Analysis

1 The DPDP Act was assented to in August 2023.

True

Assent was on 11 August 2023.

2 Appeals against the Data Protection Board go to the High Court.

False

They go to TDSAT.

3 The Act requires verifiable parental consent for children under 18.