Legislative Background and Development of the Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA-2023) marks India’s first comprehensive privacy law, enacted in response to the Supreme Court’s 2017 ruling in Justice K. Puttaswamy (Retd.) vs Union of India, which recognized the Right to Privacy as a fundamental right under Article 21 and Part III of the Indian Constitution. This legal milestone prompted the government to establish a structured framework for data protection, beginning with the appointment of a committee of experts under Justice B.N. Srikrishna in December 2018. The committee’s report, released in July 2018, laid the groundwork for the Personal Data Protection Bill, 2019, which underwent extensive public consultation and parliamentary scrutiny before being withdrawn in August 2022 due to widespread criticism.
The withdrawal of the 2019 Bill followed significant concerns, including allegations that it granted the government excessive powers to access private data under broad exemptions for sovereignty or public order. Critics, including Justice Srikrishna, warned of potential Orwellian implications, while stakeholders expressed apprehensions over the bill’s impact on digital intermediaries and cross-border data transfers. These critiques led to a revised draft, the Digital Personal Data Protection Bill, 2022, which was released for public consultation in November 2022 and further refined into the Digital Personal Data Protection Bill, 2023. The 2023 Bill was approved by the cabinet in July 2023, introduced in the Lok Sabha on August 3, 2023, and subsequently passed by both houses of Parliament before receiving presidential assent on August 11, 2023.
Unlike its predecessor, the DPDP Act focuses specifically on digital personal data, aligning with the evolving digital economy while addressing gaps identified in earlier drafts. Its passage also marked a notable linguistic progression in Indian legislation, as it was the first bill to use gender-neutral pronouns such as ‘she/her’ alongside traditional ‘he/him’ references.
Key Provisions and Scope of the DPDP Act, 2023
The DPDP Act establishes a legal framework for the processing of digital personal data, defining obligations for Data Fiduciaries*—entities responsible for collecting, storing, or processing such data—and outlining the rights of Data Principals, the individuals to whom the data pertains. Unlike the GDPR, which distinguishes between personal and sensitive personal data, the DPDP Act adopts a unified approach, treating all digital personal data under a single regulatory umbrella.
Data Fiduciaries are required to obtain explicit consent for data processing activities, with provisions for withdrawal of consent at any time. Additionally, the law imposes strict conditions on cross-border data transfers, ensuring that such transfers comply with Indian data protection standards and do not undermine the rights of Data Principals.
The Act introduces specific protections for vulnerable groups, notably prohibiting the behavioral tracking of children without explicit parental consent. For significant Data Fiduciaries—defined as entities processing large volumes of data or handling sensitive operations—the Act requires algorithmic due diligence, a measure to assess and mitigate risks associated with automated decision-making systems.
Implementation Timeline, Compliance Obligations, and Enforcement
The DPDP Act’s provisions were notified in stages, with the Digital Personal Data Protection Rules, 2025 coming into force on November 13, 2025. These rules outline the phased implementation of compliance obligations, which extend until May 2027.
Enforcement of the Act is overseen by the Data Protection Board of India, established under Section 18 of the legislation. The Board is tasked with adjudicating disputes between Data Principals and Fiduciaries, investigating complaints, and imposing penalties for non-compliance. As of November 2025, the Board has not yet appointed its members, delaying its operational capacity. Financial penalties for breaches can reach up to ₹250 crore (approximately $30 million), reflecting the Act’s emphasis on deterrence and accountability. The Board’s structure and functioning will be further detailed in subsequent notifications, though its role in overseeing significant Data Fiduciaries and conducting algorithmic audits is already outlined in the Act.
Comparative Analysis: DPDP Act vs. GDPR
While the DPDP Act shares foundational principles with the EU’s General Data Protection Regulation (GDPR), key differences distinguish its approach to data protection. The GDPR applies to all forms of personal data, whether digital or otherwise, and distinguishes between personal and sensitive personal data, imposing stricter safeguards on the latter. In contrast, the DPDP Act is limited to digital personal data, reflecting India’s focus on the digital economy and emerging technologies.
Another notable divergence lies in the legal bases for data processing.
These elements position the DPDP Act as a modern data protection framework, capable of addressing contemporary challenges in the digital age while accommodating India’s unique regulatory and economic context.
Required actions
- Obtain free, specific and informed consent, or rely on a legitimate use, before processing digital personal data, including data used to train or run models - Do not track, behaviourally monitor or target advertising at children under 18 and obtain verifiable parental consent - Significant Data Fiduciaries must appoint a resident DPO, audit annually, conduct impact assessments and ensure their algorithmic software does not risk data-principal rights - Report breaches to the Data Protection Board and affected individuals