India. Comprehensive data protection. Act
DPDP ActDigital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
§1Summary
- Synopsis
India's first horizontal data protection statute, covering digital personal data (and offline data later digitised). It relies chiefly on notice-and-consent plus a short list of 'legitimate uses', gives data principals rights to access, correction, erasure, grievance redress and nomination, and places security and breach-reporting duties on data fiduciaries. A digital-first Data Protection Board adjudicates complaints and imposes fixed-ceiling penalties.
- Key themes
- Unique features
No 'legitimate interests' basis; consent or enumerated legitimate uses only. Children are anyone under 18, with a ban on tracking, behavioural monitoring and targeted ads at children. Cross-border transfers are permitted by default except to countries the government blacklists, and data principals carry statutory duties that can attract small fines.
- SaaS relevance
Applies to any SaaS provider processing digital personal data in India, or abroad where linked to offering goods/services to people in India; B2B SaaS acting on a customer's behalf is a 'data processor' bound contractually by the fiduciary, while the fiduciary remains liable.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Board and each affected data principal without delay; detailed report to Board within 72h (per DPDP Rules)
- DPO
- Conditional
- Cross-border transfers
- Permitted except to countries restricted by Central Government notification (negative list); sectoral localisation laws prevail; SDFs may be required to keep designated data in India
- Maximum penalty
- INR 250 crore per instance (security safeguards failure); INR 200 crore for breach-notification and children's obligations
§3Dates
- Key dates
- Adopted
- In force
- Presidential assent 2023-08-11. Commenced by G.S.R. 843(E) published 2025-11-13: definitions, Chapter V (Data Protection Board) and rule-making powers from 2025-11-13; s6(9) consent-manager registration and s27(1)(d) from 2026-11-13; core obligations, rights, penalties (ss33-34) and s44(2) IT Act amendments from 2027-05-13.
§4Text and authority
- Text
- Authoritative text meity.gov.in
- Authority
- Data Protection Board of India
§5Where it applies
- Domestic law of
- India
§6Sources and verification
- Sources consulted
- Verification
High confidence.
DPO mandatory only for Significant Data Fiduciaries (must be India-based); others must publish a contact person. Government may raise Schedule penalties up to 2x by notification (s42). Exact Board website not confirmed.