Digital Personal Data Protection Act 2023 with Digital Personal Data Protection Rules 2025 Bare Act with Section Notes

Size Guide

Section 1 — Short Title, Extent & Commencement

1. This Act may be called the Digital Personal Data Protection Act, 2023.

2. It extends to the whole of India.

3. Different provisions may be commenced on different dates by notification in the Official Gazette.
   Notes: The phased commencement reflects a staged implementation (e.g., initial provisions came into force on 13 Nov 2025 with further sections by May 2027).

Section 2 — Definitions

Defines key terms including:

• Digital Personal Data, Data Principal, Data Fiduciary, Data Processor, Consent Manager, Processing, Personal Data Breach, etc.
  Notes: Directly guides interpretation throughout the Act.

CHAPTER II — OBLIGATIONS OF DATA FIDUCIARY

Section 3 — Lawful Processing

A Data Fiduciary may process digital personal data only if:
(a) Consent of the Data Principal is obtained; or
(b) Processing is authorised under specific legitimate use cases described in the Act.
Notes: Unlimited or ambiguous processing is prohibited; lawful basis must be present.

Section 4 — Consent

Consent must be:

• Free, specific, informed, unconditional, and unambiguous;

• Given by a clear affirmative action;

• Limited to the personal data necessary for the specified purpose.
  Notes: Consent withdrawal rights are built in; Data Fiduciary must cease processing following withdrawal except where authorised by law.

Section 5 — Duties of Data Fiduciary

Data Fiduciary must:

• Provide notice to Data Principal at or before the time of processing;

• Take reasonable security safeguards;

• Maintain records of processing activities;

• Ensure that personal data is accurate, complete, and kept up to date.
  Notes: These lay down operational expectations in addition to consent.

CHAPTER III — RIGHTS OF DATA PRINCIPAL

Section 9 — Rights

A Data Principal has:

• Right of access;

• Right to correction, completion, updating;

• Right to erasure;

• Right to withdraw consent;

• Grievance redressal mechanisms;

• Right to nomination (appointing another to exercise rights upon death/incapacity).
  Notes: These rights empower individuals, similar to global privacy norms.