The big picture
What the law is, who it covers, and when it starts
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
India's privacy law
The Digital Personal Data Protection Act, 2023 is India's first complete law on personal data. It applies to almost every business that handles customer, employee or user data.
Parliament passed the Act in August 2023. It replaces the thin protection that existed under Section 43A of the IT Act and the 2011 'SPDI' Rules, which stop applying once the Act's main provisions start.
Two documents work together
Think of the Act as the 'what' and the Rules as the 'how'. The Rules were notified on 13 November 2025.
Many duties in the Act say 'as may be prescribed'. The DPDP Rules, 2025 fill in those blanks. When you build a compliance programme you need both: the Act for the obligation, the Rule for the exact method or timeline.
Meet the cast
Six roles appear again and again. If your business decides why and how personal data is used, you are a Data Fiduciary, and most duties fall on you.
The fiduciary / processor split matters. Even when a vendor does the processing, the fiduciary stays responsible for compliance (s.8(1)). Processors have no direct duties under the Act; you control them through contracts.
Does it apply to you?
The law covers digital personal data, including paper records you digitise. It also reaches foreign companies that serve people in India.
There is no turnover or size threshold: a five-person startup and a bank are both Data Fiduciaries. Size matters only for the extra 'Significant Data Fiduciary' duties, the 3-year erasure rule for very large platforms, and possible Government exemptions for startups.
Key definition
Names, phone numbers, device IDs, purchase history, location: if it can be linked to a person, it is personal data.
Unlike the old SPDI Rules and the EU's GDPR, the Act does not create a special 'sensitive' class. That does not make health or financial data low-risk: the Board considers the type and nature of data when deciding penalties (s.33(2)), and sector regulators may impose stricter rules.
It switches on in three phases
For most businesses the date that matters is May 2027. That is when notice, consent, security, breach reporting, rights and penalties all start.
Phase 1 brought in s.1(2), s.2, s.18 to 26 and s.35, 38 to 43 of the Act and Rules 1, 2 and 17 to 21. Phase 2 brings in s.6(9), s.27(1)(d) and Rule 4. Phase 3 brings in the remaining sections, including the obligations in s.3 to 17 and penalties, plus Rules 3, 5 to 16, 22 and 23. The Rules count one year and eighteen months from publication in the Official Gazette. The notification is dated 13 November 2025; some commentators count from 14 November, so you will see both 13 and 14 quoted for the November 2026 and May 2027 dates.
Watch this space
Plan for May 2027, but build early. The deadline could move closer, especially for Significant Data Fiduciaries.
In November 2025 the IT Minister said the Government would compress the timeline, and in January 2026 MeitY consulted on cutting it to 12 months, with feedback due by 4 February 2026. Changing commencement dates needs a notification in the Gazette. Check the Gazette and MeitY's website for any amendment before relying on the May 2027 date.
The ideas behind every rule
Every duty in the law flows from a few simple ideas. If you remember these seven, the details will make sense.
These principles come from the Government's explanation of the Bill. They are not separate legal tests, but they explain why each duty exists and are a good lens for grey areas.
In one line
That's the big picture. Next, the foundation of everything: getting permission right.