Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025
Why in news: Rule 4 of the DPDP Rules, 2025, on registering Consent Managers, comes into force in November 2026, one year after the Rules' Gazette publication.
The Digital Personal Data Protection Act, 2023 governs how organisations, called Data Fiduciaries, collect and use people's digital personal data, mainly on consent, enforced by a Data Protection Board of India. Its Rules, published in the Gazette on 13 November 2025, phase in duties over eighteen months; the rule on registering Consent Managers takes effect in November 2026.
Syllabus: Prelims · Polity & Governance; GS2 · Statutory & Regulatory Bodies; GS2 · Governance & e-Governance
Why this matters for UPSC
GS2 governance and GS3 cyber security: Prelims can ask who a Data Fiduciary is, what Consent Managers do and where Board appeals go; Mains can ask how the DPDP Act, 2023 balances privacy after Puttaswamy with innovation and RTI.
In short
The Digital Personal Data Protection Act, 2023 is India's comprehensive law on digital personal data, balancing an individual's right to protect her data against lawful processing needs.
The framework is sound on paper; its worth now rests on a working, independent-minded Board and exemptions used narrowly enough to keep Puttaswamy's promise.
Why it matters
Every time a person shares a phone number with a shop, a photo with an app or Aadhaar details with a bank, a company now owes that person a clear notice, safe storage and an answer to requests to see, correct or delete the data. If a leak happens, the person must be told quickly and, if the company's own grievance process fails, can complain online to the Data Protection Board instead of going to court. Parents gain a say before apps use their children's data. Businesses, from start-ups to large platforms, must change how they collect and keep data, and heavy fines raise the cost of carelessness. The larger question is how a digital economy can grow while privacy stays a working right.
Prelims pointers
- DPDP Act, 2023: Act No. 22 of 2023; President's assent on 11 August 2023; its Rules are made under section 40.
- Section 3: the Act also covers processing outside India linked to offering goods or services to Data Principals in India.
- Exclusions: data processed for personal or domestic purposes, and data the Data Principal herself made publicly available, fall outside the Act.
- Section 9: no tracking, behavioural monitoring or targeted advertising directed at children; under section 2(f), a child is anyone under eighteen.
- Section 5: a notice must be available in English or any language of the Eighth Schedule to the Constitution.
- Penalty Schedule: up to Rs 250 crore for failing security safeguards; up to Rs 50 crore for other fiduciary violations.
- Section 6(10): when consent is questioned in a proceeding, the Data Fiduciary must prove that notice was given and consent obtained.
- Puttaswamy (2017): a nine-judge Bench upheld privacy as a right protected by Article 21 of the Constitution.
Practise a UPSC-style question
With reference to the Digital Personal Data Protection Act, 2023, consider the following statements:
1. It also applies to processing outside India linked to offering goods or services to Data Principals in India.
2. A Data Fiduciary must let the Data Principal read its notice in English or any Eighth Schedule language.
Which of the statements given above is/are correct?
- (a) 1 only
- (b) 2 only
- (c) Both 1 and 2
- (d) Neither 1 nor 2
Show the answer
Answer: (c) Both 1 and 2
Answer: (c) Both 1 and 2. The Act reaches offshore processing aimed at India and guarantees notices in Indian languages.
Statement 1: correct. Section 3(b) extends the Act to processing outside India connected with offering goods or services to Data Principals in India.
Statement 2: correct. Section 5(3) gives the Data Principal the option to read the notice in English or any language in the Eighth Schedule to the Constitution.
Eliminate: statement 1 is the Act's extraterritorial reach, a feature of most modern data laws. Out: (b), (d).
Eliminate: statement 2 matches section 5(3) on the language of notice. Out: (a).
Trap: Wrong scope. A student may assume an Indian law stops at India's borders and drop statement 1, though section 3(b) follows the data of people in India.
Remember: DPDP Act reaches foreign processors serving India; notices come in English or any Eighth Schedule language.
More Explainers
- State Legislative Councils: Articles 168-172 and the graduates' and teachers' seats Polity
- Whales and dolphins in Indian waters: legal protection, IUCN status and strandings Environment
- The Aligarh Movement, AMU and the Article 30 minority test Polity
- Environmental clearance by States: SEIAA, SEAC and the EIA Notification, 2006 Environment
- Software vulnerabilities: CVE, CVSS, coordinated disclosure and CERT-In's role Sci-Tech
- Drug trafficking law in India: NDPS Act, PIT-NDPS, NCB and NCORD National
- Choosing the UN Secretary-General: Article 97, UNSC veto and straw polls World & IR
- UN Convention against Torture, and why India has not ratified it Polity
- NavIC: why India's navigation constellation cannot give a standalone position Sci-Tech
- International Energy Agency: membership, 90-day oil stocks and India's status World & IR
- PM Surya Ghar: Muft Bijli Yojana and the rooftop solar subsidy Economy
- HFSS foods: FSSAI's draft limits and front-of-pack warning labels National