Legislative Background and Evolution of India’s Data Protection Framework
The Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA-2023) marks India’s first comprehensive legislative effort to regulate the processing of digital personal data. Its development traces back to the Supreme Court’s landmark 2017 verdict in Justice K. Puttaswamy (Retd.) vs Union of India, which recognized the Right to Privacy as a fundamental right under Article 21 and Part III of the Indian Constitution. This ruling set the stage for India’s data protection framework, prompting the government to establish a structured approach to safeguarding personal data.
Following the verdict, the Ministry of Electronics and Information Technology (MeitY) constituted a committee of experts under the chairmanship of Justice B.N. Srikrishna in December 2018. This committee released the Data Protection Committee Report in July 2018, which laid the groundwork for the Personal Data Protection Bill, 2019. The bill underwent extensive public consultation, stakeholder feedback, and modifications before being tabled in the Lok Sabha on December 11, 2019. However, due to widespread criticism—including concerns over excessive government access to private data and potential Orwellian implications—the bill was withdrawn on August 3, 2022.
The withdrawal led to the introduction of the Digital Personal Data Protection Bill, 2022, released for public consultation on November 18, 2022. After incorporating feedback, the revised Digital Personal Data Protection Bill, 2023 was approved by the cabinet on July 5, 2023, and subsequently passed by both houses of Parliament in August 2023. President Draupadi Murmu’s assent on August 11, 2023, formalized the act into law. Notably, the DPDP Act-2023 was the first Indian legislation to use gender-neutral pronouns, replacing traditional ‘he/him’ references with ‘she/her’ where applicable.
Its final form addresses gaps in earlier drafts while aligning with global standards, though it retains key differences from frameworks like the EU’s General Data Protection Regulation (GDPR).
Key Provisions of the Digital Personal Data Protection Act, 2023
Unlike its predecessor, the act focuses exclusively on digital personal data, excluding offline or non-digital data from its scope. This distinction sets it apart from broader regulations like GDPR, which apply to all forms of personal data.
Obligations of Data Fiduciaries
Data Fiduciaries—including corporations, government entities, and non-profits—must adhere to strict processing principles. These include obtaining explicit, informed, and freely given consent from Data Principals before collecting or processing their data.
Rights of Data Principals
- Right to Grievance Redressal: Individuals can lodge complaints with the Data Protection Board of India (DPB) or the Fiduciary itself for violations.
These rights are enforceable, and Data Principals can approach the DPB for redressal in cases of non-compliance.
Financial Penalties and Enforcement
The Data Protection Board of India (DPB) is empowered to investigate complaints, impose penalties, and order corrective measures. The DPB’s establishment was formally brought into force on November 13, 2025, marking the beginning of its operational phase.
Comparison with GDPR
While the DPDP Act-2023 shares similarities with GDPR—such as consent-based processing, data subject rights, and breach notification requirements—it diverges in critical aspects. Unlike GDPR, the act does not distinguish between personal data and sensitive personal data, applying uniform protections across all digital personal data.
The legal bases for processing also differ: GDPR relies on six lawful grounds (e.g., consent, contractual necessity), while the DPDP Act primarily hinges on consent, with limited exceptions for state functions or legal obligations.
Implementation Phases and Application to AI Systems
The Digital Personal Data Protection Rules, 2025 (DPDP Rules) specify operational details, including security safeguards, breach notification protocols, and compliance timelines. These rules apply uniformly to all entities processing digital personal data, including AI systems, which are increasingly relied upon for data-driven decision-making.
Security Safeguards and Breach Notification
The notification must include the nature of the breach, affected data categories, and mitigative actions taken.
For AI systems, these requirements translate to stringent data governance measures. AI models trained on personal data must adhere to the same consent, transparency, and security principles as other data processing activities. For example, an AI-driven recommendation system collecting user data must obtain explicit consent, disclose its data usage, and ensure the data is stored securely.
Phased Implementation and Compliance Deadlines
The final compliance deadline is May 2027, by which all Data Fiduciaries must fully adhere to the act’s provisions.
While the act does not explicitly mention AI, its principles—such as the right to explanation (inferred from the right to confirmation and access) and non-discrimination—directly impact AI-driven systems.
Exemptions and Government Oversight
This balance reflects the tension between individual privacy rights and state interests, a recurring theme in India’s data protection discourse. The DPB’s role in adjudicating disputes between Data Principals and Fiduciaries—including those involving AI systems—ensures a mechanism for resolving conflicts without resorting to lengthy litigation.
The phased approach allows smaller entities and startups additional time to adapt, though all must demonstrate compliance by the final deadline.
Key dates
- 11 Aug 2023Act notified in the Gazette
- 14 Nov 2025DPDP Rules notified; Board and consent provisions effective
- 14 Nov 2026Consent manager provisions apply
- 14 May 2027Remaining obligations apply