Legislation / ActIndia

Digital Personal Data Protection Act, 2023 (DPDP Act)

India's framework for the processing of digital personal data, balancing individuals' rights and lawful processing.

Verify current status

Obligations commence in phases — most substantive duties apply from 13 May 2027. Confirm phase dates against the Gazette.

Classification

Legislation / Act

Issuing authority

Parliament of India (administered by MeitY)

Jurisdiction

India · Sector: All

Status / edition

Enacted; commencement notified in phases

Key dates

Enacted 11 Aug 2023; commencement notification G.S.R. 843(E) issued 13 Nov 2025 alongside the Rules

Mandatory or voluntary

Conditional

Who it applies to

Processing of digital personal data within India, and certain processing outside India connected to offering goods or services to data principals in India.

Purpose

India's framework for the processing of digital personal data, balancing individuals' rights and lawful processing.

Major requirements / obligations

  • Lawful basis / consent
  • Notice and purpose limitation
  • Data principal rights
  • Security safeguards and breach handling
  • Additional duties for Significant Data Fiduciaries

Control domains

PrivacyGovernanceIncident response

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.