Policy Explainers
Digital Personal Data Protection Act, 2023

DPDP Act, Explained

India's first complete law on personal data, and the DPDP Rules, 2025 that put it into practice. Watch a chapter, or read the same material as an animated guide.

The law
Act No. 22 of 2023, with the DPDP Rules, 2025
Main duties start
May 2027
Top penalty
₹250 crore per instance
Regulator
Data Protection Board of India

For businessesFor NGOsFor citizensFor small businesses and startupsSection-by-section reference

For businesses

The full Act and Rules from the point of view of an organisation that handles personal data.

  1. 1The big pictureWhat the law is, who it covers, and when it starts4:09
  2. 2Getting permission rightNotice, consent, legitimate uses and Consent Managers3:27
  3. 3Your everyday dutiesAccountability, accuracy, security, retention and contacts3:06
  4. 4When something goes wrongPersonal data breaches and the 72-hour report2:52
  5. 5Children and persons with disabilityParental consent, banned practices and exemptions2:18
  6. 6The rights of the people you serveAccess, correction, erasure, grievances and nomination2:08
  7. 7Big players, borders and exceptionsSignificant Data Fiduciaries, cross-border transfers and exemptions2:21
  8. 8Enforcement and your action planThe Board, penalties, and the road to May 20273:12

For NGOs

Beneficiary data, field consent, children, funders and partners, for trusts, societies and Section 8 companies.

  1. 1Does the Act apply to your NGO?Who is covered, which role you play, and when it starts3:37
  2. 2Consent in the fieldNotices, real consent, proof, and when consent is not needed4:08
  3. 3Children and vulnerable peopleParental consent, banned practices, exemptions and photos4:05
  4. 4Funders, partners and researchSharing data, contracts, research and transfers abroad4:21
  5. 5Security, breaches and your planSafeguards, retention, breach steps, requests and a plan4:27

For citizens

Your rights over your own data: what organisations must tell you, and how to complain.

  1. 1Your data, your rightsWhat the law is, who is who, and when your protections begin3:42
  2. 2What you agree to when you consentNotices, valid consent, withdrawing it, and when none is needed4:08
  3. 3Access, correction and erasureSeeing your data, fixing it, and getting it deleted3:55
  4. 4Children, parents and nomineesExtra protection for under-18s, and who can act for you4:03
  5. 5Breaches and complaintsWhat you must be told, where to complain, and what to expect4:25

For small businesses and startups

A short, practical edition for small teams with no legal department.

  1. 1Are you covered? The ten-minute versionNo size threshold, your role, the dates and the penalties3:52
  2. 2Collect less, ask clearlyLawful grounds, short notices, consent and children's data3:56
  3. 3Security and breaches on a budgetLow-cost safeguards, vendors, retention and the 72-hour report4:21
  4. 4A 30-day starter planFour weeks to get the basics in place4:15