Also: Digital Personal Data Protection Act 2023, DPDP Act, DPDP Rules 2025
Definition
India's first comprehensive law on protecting digital personal data, passed in August 2023, which sets rules for how organisations collect and use personal data, gives individuals rights, and creates the Data Protection Board of India.
In K.S. Puttaswamy v. Union of India (2017), a nine-judge bench of the Supreme Court declared privacy a fundamental right under Article 21, and asked the government to put in place a robust data protection regime. A committee chaired by retired Justice B.N. Srikrishna submitted a draft bill in 2018. A Personal Data Protection Bill was introduced in 2019 and examined by a Joint Parliamentary Committee, but the government withdrew it in 2022, saying a simpler framework was needed. A new draft was released for consultation in November 2022, and the Digital Personal Data Protection Act was passed in August 2023.
Before this, data protection in India relied mainly on Section 43A of the Information Technology Act 2000 and the 2011 rules on "sensitive personal data", which were limited in scope and enforcement. The DPDP Act takes a principles-based, shorter approach than Europe's General Data Protection Regulation (GDPR), and leaves many details to rules, which were notified in 2025 with a phased timeline for compliance.
Create a free account to read 5 full pages a month, or upgrade for unlimited access. The definition above, the A–Z index and the pop-up definitions in lessons stay free.
