DPDPA: The Complete Guide
The Digital Personal Data Protection Act, 2023, is India's first comprehensive data protection legislation. Signed into law in August 2023, the DPDPA applies to the processing of digital personal data within India and to processing outside India when it relates to offering goods or services to individuals in India.
What the DPDPA Covers
The DPDPA is built on a consent-driven model. Data Fiduciaries (equivalent to controllers under the GDPR) must provide clear, itemized notice to Data Principals (individuals) before collecting personal data and obtain free, specific, informed, and unambiguous consent. The law recognizes "deemed consent" in certain situations, such as employment or public interest.
Data Principals receive rights to access information about their data, request correction and erasure, nominate a representative, and file grievances. Uniquely, the DPDPA also imposes duties on Data Principals, including a duty not to file false complaints and a duty to provide authentic information.
The Act creates the category of Significant Data Fiduciaries — entities designated by the government based on volume, sensitivity of data, and risk — which face heightened obligations including appointing a Data Protection Officer, conducting Data Protection Impact Assessments, and undergoing periodic audits.
Children's Data Protections
The DPDPA prohibits processing children's personal data without verifiable parental consent and bans behavioral monitoring and targeted advertising directed at children. The government may exempt certain Data Fiduciaries from these requirements where processing is demonstrably safe.
Cross-Border Transfers
Rather than adopting an adequacy-based model, the DPDPA permits cross-border data transfers to all countries except those specifically restricted by the Indian government. The government maintains a negative list of jurisdictions to which transfers are prohibited.
Enforcement and Penalties
The Data Protection Board of India adjudicates complaints and imposes penalties. Maximum penalties reach 250 crore rupees (approximately $30 million) per violation, with the highest penalties reserved for failure to implement security safeguards resulting in a breach.
Practical Compliance Steps
- Notice and consent — Implement clear, itemized consent mechanisms for all data collection
- Grievance redressal — Establish a process for Data Principals to file and track grievances
- Children's data — Implement age verification and parental consent mechanisms
- Cross-border assessment — Verify that data transfer destinations are not on the restricted list
- Significant Data Fiduciary evaluation — Assess whether your organization may be designated and prepare for heightened obligations