ResourcesThe Act
Digital Personal Data Protection Act, 2023
Act No. 22 of 2023 · Published 11 August 2023 · Official text, section by section
Download PDF of the DPDP Act, 2023English · 21 pages · 178 KBRead the full textOfficial copy (MeitY) (opens in a new tab)
Search the Act
Look up a word, a figure such as “72 hours”, or go straight to a provision with “section 8”. Every result opens the official text.
Try:
At a glance
Figures taken from the text. Each one links to the provision it comes from.
Up to ₹250 crore
Highest penalty ceiling in the Schedule
The penalty for failing to take reasonable security safeguards (section 8(5)) “may extend to” two hundred and fifty crore rupees.
Source: The Schedule, item 1
Under 18
Age of a child
A “child” is an individual who has not completed the age of eighteen years.
Commencement: 13 November 2025Source: Section 2(f)
Any time
Withdrawing consent
Where consent is the basis of processing, the Data Principal may withdraw it at any time, with comparable ease to giving it.
Source: Section 6(4)
2 years
Term of the Board's Chairperson and Members
The Chairperson and other Members of the Board hold office for a term of two years and are eligible for re-appointment.
Commencement: 13 November 2025Source: Section 20(2)
60 days
Time to appeal a Board order
Appeals to the Appellate Tribunal are due within sixty days of receipt; a late appeal may be entertained for sufficient cause.
Commencement: 13 May 2027 (computed)Source: Section 29(2) and (3)
44 sections
In nine chapters, plus one Schedule
The Act has 44 sections in nine chapters, followed by a single Schedule of monetary penalties.
The Act, section by section
Titles are as printed in the Gazette. The “in brief” lines and commencement dates are Agicentral’s own aids.
Chapter IPreliminary
3 sections
- 1 SectionShort title and commencementGives the Act its short title and says it takes effect on dates the Central Government notifies, which can differ for different provisions.Commencement: 13 November 2025 (sub-section (2))
- 2 SectionDefinitionsSets out the meanings of terms used in the Act, such as Data Fiduciary, Data Principal, Consent Manager, personal data breach and processing, unless the context requires otherwise.Commencement: 13 November 2025
- 3 SectionApplication of ActSets out where the Act applies — digital personal data processed in India, and abroad when linked to offering goods or services to Data Principals in India — with exceptions such as personal or domestic use.Commencement: 13 May 2027 (computed)
Chapter IIObligations of Data Fiduciary
7 sections
- 4 SectionGrounds for processing personal dataAllows a person to process a Data Principal's personal data only for a lawful purpose, meaning one not expressly forbidden by law, and either with her consent or for certain legitimate uses.Commencement: 13 May 2027 (computed)
- 5 SectionNoticeRequires a Data Fiduciary to give a notice with or before each consent request, covering the data and purpose, how to exercise rights and how to complain to the Board, as prescribed.Commencement: 13 May 2027 (computed)
- 6 SectionConsentSets what valid consent looks like — free, specific, informed, unconditional and unambiguous — and covers the right to withdraw, Consent Managers, and the Data Fiduciary's duty to prove notice and consent.Commencement: 13 November 2026 (computed) and 13 May 2027 (computed) (by part)
- 7 SectionCertain legitimate usesLists the “certain legitimate uses” for which a Data Fiduciary may process personal data, such as data voluntarily provided for a specified purpose, State functions, legal compliance, medical emergencies and employment.Commencement: 13 May 2027 (computed)
- 8 SectionGeneral obligations of Data FiduciaryMakes the Data Fiduciary responsible for complying with the Act, including for processing by its Data Processors, and sets duties such as security safeguards, breach notification, data erasure and grievance redress.Commencement: 13 May 2027 (computed)
- 9 SectionProcessing of personal data of childrenRequires verifiable consent from a child's parent or lawful guardian, and bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions; processing likely to harm a child's well-being is also barred.Commencement: 13 May 2027 (computed)
- 10 SectionAdditional obligations of Significant Data FiduciaryLets the Central Government notify certain Data Fiduciaries as Significant Data Fiduciaries, which then take on extra duties such as appointing a Data Protection Officer, an independent data auditor and periodic impact assessments.Commencement: 13 May 2027 (computed)
Chapter IIIRights and duties of Data Principal
5 sections
- 11 SectionRight to access information about personal dataLets a Data Principal request from the Data Fiduciary she consented to a summary of her data being processed and who it was shared with, except for certain sharing to investigate offences.Commencement: 13 May 2027 (computed)
- 12 SectionRight to correction and erasure of personal dataGives a Data Principal who has consented the right to correction, completion, updating and erasure of her personal data, with erasure on request unless retention is necessary for the specified purpose or legal compliance.Commencement: 13 May 2027 (computed)
- 13 SectionRight of grievance redressalGives a Data Principal the right to readily available grievance redressal from a Data Fiduciary or Consent Manager, with a response due within a prescribed period, and requires using it before approaching the Board.Commencement: 13 May 2027 (computed)
- 14 SectionRight to nominateLets a Data Principal nominate another individual to exercise her rights in the event of her death or incapacity (unsoundness of mind or infirmity of body), in the manner the Rules prescribe.Commencement: 13 May 2027 (computed)
- 15 SectionDuties of Data PrincipalLists duties of a Data Principal, such as complying with applicable laws when exercising rights, not impersonating another person, not filing false or frivolous grievances, and giving only verifiably authentic information for correction or erasure.Commencement: 13 May 2027 (computed)
Chapter IVSpecial provisions
2 sections
- 16 SectionProcessing of personal data outside IndiaLets the Central Government restrict, by notification, transfers of personal data for processing to notified countries or territories outside India, without displacing Indian laws that give higher protection or stricter transfer restrictions.Commencement: 13 May 2027 (computed)
- 17 SectionExemptionsLists situations, such as enforcing legal claims or investigating offences, where some or all of the Act's provisions do not apply, and lets the Central Government exempt notified State bodies and Data Fiduciaries such as startups.Commencement: 13 May 2027 (computed)
Chapter VData Protection Board of India
9 sections
- 18 SectionEstablishment of BoardSets up the Data Protection Board of India from a date the Central Government notifies, as a body corporate with perpetual succession and a common seal, able to hold property, contract and sue or be sued.Commencement: 13 November 2025
- 19 SectionComposition and qualifications for appointment of Chairperson and MembersSets out the Board's composition: a Chairperson and other Members appointed by the Central Government, drawn from people with expertise in fields such as data governance, law or techno-regulation, including at least one law expert.Commencement: 13 November 2025
- 20 SectionSalary, allowances payable to and term of officeProvides that the Chairperson's and Members' salary and service terms are as prescribed and cannot be varied to their disadvantage after appointment, and sets a two-year term with eligibility for re-appointment.Commencement: 13 November 2025
- 21 SectionDisqualifications for appointment and continuation as Chairperson and Members of BoardLists grounds, such as insolvency, a conviction involving moral turpitude or abuse of position, that disqualify a person from appointment or continuing as Chairperson or Member, and bars the Central Government from removing one without a hearing.Commencement: 13 November 2025
- 22 SectionResignation by Members and filling of vacancyLets a Chairperson or Member resign by written notice, says when resignation takes effect, provides for filling vacancies, and restricts accepting employment for one year after leaving office without the Central Government's approval.Commencement: 13 November 2025
- 23 SectionProceedings of BoardLeaves how the Board conducts business, including digital meetings, to the Rules; protects its acts from invalidity merely because of vacancies or certain defects; and has the senior-most Member act for an absent Chairperson.Commencement: 13 November 2025
- 24 SectionOfficers and employees of BoardLets the Board, with the Central Government's previous approval, appoint the officers and employees it considers necessary for efficient discharge of its functions, on terms the Rules prescribe.Commencement: 13 November 2025
- 25 SectionMembers and officers to be public servantsTreats the Chairperson, Members, officers and employees of the Board as public servants within the meaning of section 21 of the Indian Penal Code when acting or purporting to act under the Act.Commencement: 13 November 2025
- 26 SectionPowers of ChairpersonSets out the Chairperson's powers: general superintendence of the Board's administrative matters, authorising officers to scrutinise complaints and correspondence, and allocating proceedings among individual Members or groups of Members.Commencement: 13 November 2025
Chapter VIPowers, functions and procedure to be followed by Board
2 sections
- 27 SectionPowers and functions of BoardSets out the Board's powers, such as directing urgent remedial measures after a personal data breach, inquiring into breaches on complaint or reference and imposing penalties under the Act, and issuing directions after a hearing.Commencement: 13 November 2026 (computed) and 13 May 2027 (computed) (by part)
- 28 SectionProcedure to be followed by BoardSets out how the Board handles complaints and inquiries — digital by design as far as practicable, following natural justice, with civil-court powers such as summoning persons — including interim orders and closing proceedings.Commencement: 13 May 2027 (computed)
Chapter VIIAppeal and alternate dispute resolution
4 sections
- 29 SectionAppeal to Appellate TribunalLets a person aggrieved by a Board order or direction appeal to the Appellate Tribunal within sixty days of receipt, extendable for sufficient cause; the Tribunal may confirm, modify or set aside the order.Commencement: 13 May 2027 (computed)
- 30 SectionOrders passed by Appellate Tribunal to be executable as decreeMakes an Appellate Tribunal order executable as a civil-court decree, either by the Tribunal itself or by a local civil court to which the Tribunal transmits it.Commencement: 13 May 2027 (computed)
- 31 SectionAlternate dispute resolutionLets the Board direct parties to try mediation where it thinks a complaint can be resolved that way, using a mediator they agree on or one provided under Indian law.Commencement: 13 May 2027 (computed)
- 32 SectionVoluntary undertakingLets the Board accept a person's voluntary undertaking at any stage of a section 28 proceeding; once accepted it bars proceedings on its contents, but breaching it is treated as breach of the Act.Commencement: 13 May 2027 (computed)
Chapter VIIIPenalties and adjudication
2 sections
- 33 SectionPenaltiesLets the Board, after an inquiry and a hearing, impose a monetary penalty specified in the Schedule for a significant breach, having regard to factors such as the breach's gravity, duration and any gain realised.Commencement: 13 May 2027 (computed)
- 34 SectionCrediting sums realised by way of penalties to Consolidated Fund of IndiaCredits all sums realised through penalties imposed by the Board under the Act to the Consolidated Fund of India.Commencement: 13 May 2027 (computed)
Chapter IXMiscellaneous
10 sections
- 35 SectionProtection of action taken in good faithBars suits, prosecutions or other legal proceedings against the Central Government, the Board and its Chairperson, Members, officers and employees for anything done, or intended to be done, in good faith under the Act or its rules.Commencement: 13 November 2025
- 36 SectionPower to call for informationLets the Central Government, for the purposes of the Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it calls for.Commencement: 13 May 2027 (computed)
- 37 SectionPower of Central Government to issue directionsLets the Central Government, on a Board reference after penalties on a Data Fiduciary in two or more instances, direct an agency or intermediary to block public access to certain information, after hearing the Data Fiduciary.Commencement: 13 May 2027 (computed)
- 38 SectionConsistency with other lawsProvides that the Act applies in addition to, and does not detract from, other laws in force, and prevails over any other law to the extent of a conflict.Commencement: 13 November 2025
- 39 SectionBar of jurisdictionStops civil courts from hearing suits or proceedings on matters the Board is empowered to deal with, and bars any court or authority from granting injunctions against action taken or to be taken under the Act's powers.Commencement: 13 November 2025
- 40 SectionPower to make rulesEmpowers the Central Government to make rules to carry out the Act, and lists matters they may cover, such as how notices inform Data Principals, Consent Manager registration, breach intimation to the Board and appeal procedure.Commencement: 13 November 2025
- 41 SectionLaying of rules and certain notificationsRequires rules, and notifications under sections 16 and 42, to be laid before Parliament for thirty days, and lets both Houses agree to modify or annul them, without invalidating anything already done under them.Commencement: 13 November 2025
- 42 SectionPower to amend ScheduleLets the Central Government amend the Schedule by notification, but not increase any penalty to more than twice the amount originally specified; amendments take effect from the date of notification.Commencement: 13 November 2025
- 43 SectionPower to remove difficultiesLets the Central Government, by order, make provisions consistent with the Act to remove difficulties in giving effect to it, but not after three years from commencement; orders are laid before Parliament.Commencement: 13 November 2025
- 44 SectionAmendments to certain ActsAmends three Acts: the Telecom Regulatory Authority of India Act (adding this Act's Appellate Tribunal), the Information Technology Act (including omitting section 43A) and the Right to Information Act (replacing section 8(1)(j) on personal information).Commencement: 13 November 2025 and 13 May 2027 (computed) (by part)
The Schedule
1 schedule
Schedule descriptions are Agicentral’s labels for navigation, not part of the law.
Keep exploring
DPDP Rules, 2025
The 23 rules and 7 Schedules that fill in the Act’s detail, read rule by rule.
OpenTimeline of key dates
When each part of the Act and the Rules begins, on one page.
OpenAct-to-Rules map
Which rules relate to which section of the Act.
OpenGlossary
Every term the Act and the Rules define, in the exact words of the Gazette, linked to the provision.
OpenAbout this text
Reproduced verbatim from the official Gazette PDF. Text last verified against the official PDF on 1 October 2026.
- Instrument
- The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
- Published
- 11 August 2023 · The Gazette of India, Extraordinary, Part II — Section 1, No. 25, New Delhi, Friday, 11 August 2023 (CG-DL-E-12082023-248045)
- Issued by
- Ministry of Law and Justice (Legislative Department)
Official sources
- The DPDP Act, 2023 — official Gazette PDF (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
- G.S.R. 843(E) — dates on which the Act's provisions come into force (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
General information, not legal advice. The Gazette notification is the authoritative text. The summaries, links and labels around the text are Agicentral’s own and are not part of the law.
Read the law, then see where you stand.
Take the ten-minute DPDPA readiness assessment and get a clear view of the gaps that matter for your organisation.