Nyaykosh
Home / Laws / Digital Personal Data Protection Act
Data ProtectionIn forceLegacy – pending validation

Digital Personal Data Protection Act, 2023

Governs the processing of digital personal data, balancing individuals' right to protect their data with the need to process it for lawful purposes.

Versions and amendment history

Original Act, amendments and notices

  1. Original ActVersion 1Current versionLegacy – pending validationIn force · In force from the start · Published 13 Nov 2026

Official text

Verbatim from the Gazette

  1. S. 4 Grounds for Processing Personal Data

    A person may process the personal data of a Data Principal only for a lawful purpose for which the Data Principal has given consent, or for certain legitimate uses.

    Obligations under this section

    • Consent must be free, specific, informed, unconditional and unambiguous.
    • Processing limited to the purpose for which consent was given.
    • Legitimate uses include state benefits, employment and medical emergencies.

  2. S. 5 Notice

    Every request for consent must be accompanied by a notice informing the Data Principal of the personal data and purpose of processing.

    Obligations under this section

    • Notice must be in clear and plain language.
    • Must be available in English and the 22 scheduled languages.
    • Must describe how to exercise rights and file complaints.

  3. S. 6 Consent

    Consent given by the Data Principal shall be limited to such personal data as is necessary for the specified purpose.

    Obligations under this section

    • Data Principal may withdraw consent at any time.
    • Withdrawal must be as easy as giving consent.
    • Consent Managers must be registered with the Board.

  4. S. 8 Duties of Data Fiduciary

    A Data Fiduciary must implement appropriate technical and organisational measures and protect personal data in its possession.

    Obligations under this section

    • Implement reasonable security safeguards to prevent breaches.
    • Notify the Board and affected Data Principals of any breach.
    • Erase personal data when consent is withdrawn or purpose served.

  5. S. 9 Processing Data of Children

    A Data Fiduciary must obtain verifiable consent of a parent before processing the personal data of a child (under 18).

    Obligations under this section

    • No tracking or behavioural monitoring of children.
    • No targeted advertising directed at children.
    • Verifiable parental consent required.

  6. S. 33 Penalties

    The Data Protection Board may impose monetary penalties for breach of the provisions of the Act, up to ₹250 crore per instance.

    Obligations under this section

    • Up to ₹250 crore for failure to prevent a data breach.
    • Up to ₹200 crore for failure of obligations relating to children.
    • Up to ₹50 crore for breach of other duties.

Compliance Rules

14 rules

Significant Data Fiduciary

2 triggers · 9 rules

Data Fiduciary

2 triggers · 5 rules

Consumable API

JSON endpoints. Read access is open; no key is needed.

# Fetch the full law as JSON
curl http://backend.laac-dev.local:8000/laac-api/v1/laws/dpdp-2023

# Just the penalty schedule
curl http://backend.laac-dev.local:8000/laac-api/v1/laws/dpdp-2023/penalties

# A specific provision
curl http://backend.laac-dev.local:8000/laac-api/v1/laws/dpdp-2023/provisions/s4