The Act
Act 22 of 2023
When and how the Act comes into forceThis is the section that names the law and switches it on.
The vocabulary of the Act - Data Principal, Fiduciary, and moreThis is the Act's dictionary.
Where the Act applies - within India and beyondThis section draws the boundary of the law - where it applies and where it does not.
The lawful bases on which data may be processedYou cannot process someone's personal data simply because you hold it - you need a lawful ground.
What a Data Principal must be told, and howBefore or when you ask someone for consent, you must give them a clear notice.
Free, specific, informed, unambiguous - the gold standardThis section sets the quality bar for consent.
When data may be used without fresh consentSection 7 is a closed list of 'certain legitimate uses' that can support processing without relying on consent under Section 6.
Accuracy, security safeguards and breach dutiesThis section is the Fiduciary's core duty list.
Verifiable parental consent and a ban on trackingChildren get extra protection.
DPIA, audits and a Data Protection OfficerSome organisations handle so much, or such sensitive, personal data that the Central Government can designate them a 'Significant Data Fiduciary'.
Know what is processed and with whom it is sharedThis is your right to ask a Fiduciary what it is doing with your data.
Fix, update or delete your personal dataIf a Fiduciary holds wrong, incomplete or outdated data about you, this right lets you require them to correct, complete or update it.
A readily available means to raise complaintsEvery Fiduciary - and every Consent Manager - must give you an easy, readily available way to raise complaints about how they handle your data or your rights, and must respond within the time the Rules set.
Name someone to exercise your rights if neededThis right lets you name another person to step into your shoes and exercise your data rights if you die or become unable to act for yourself.
What the law expects of individuals in returnRights come with responsibilities.
Cross-border transfers and government restrictionsThis section governs sending personal data abroad.
Where certain obligations do not applyNot every obligation fits every situation, so this section lists where large parts of the Act are switched off.
Creating the Data Protection Board of IndiaThis section creates the regulator - the Data Protection Board of India.
Who sits on the Board and how they are chosenThis sets who runs the Board.
Terms of service for MembersThis fixes the Board members' terms of service.
Grounds that bar appointment or continuationThis lists what bars someone from being appointed, or continuing, as Chairperson or Member - being adjudged insolvent, a conviction involving moral turpitude, becoming physically or mentally incapable, acquiring a conflicting financial interest, or abusing the office.
How Members leave and seats are refilledThis covers how members leave and how their seats are filled.
How the Board conducts its businessThis lets the Board run its own business - including meeting by digital means - and authenticate its orders and directions in the manner the Rules prescribe.
The Board's supporting staffThis lets the Board hire the officers and employees it needs to function effectively, with the prior approval of the Central Government and on the terms and conditions prescribed.
Their status under the lawWhen acting under the Act, the Board's Chairperson, Members, officers and employees count as 'public servants' in law.
Management and administrative powersThis gives the Chairperson the levers to run the Board: general superintendence and direction over all administrative matters, authority to have officers scrutinise complaints and correspondence, and the power to allocate the Board's proceedings among individual Members or groups of Members.
Inquiry, direction and remedial powersThis is what the Board actually does.
How matters are heard and decidedThis tells the Board how to work: as an independent body, digital by design, that receives complaints and hears and decides them online.
Challenging the Board's ordersIf you are unhappy with a Board order, you can appeal to the Appellate Tribunal - the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Enforcing Tribunal ordersThis gives the Tribunal's orders real teeth.
Mediation as an alternative pathThe Board does not have to litigate everything.
Settling a matter by commitmentA person facing a proceeding can offer the Board a voluntary undertaking - a promise to take, or refrain from, specified action within a set time.
No suit lies for acts done in good faith under the ActThis shields the Government, the Board and its people from lawsuits for anything done, or intended to be done, in good faith under the Act.
The Government may require information from a Fiduciary or intermediaryThis lets the Central Government require the Board, or any Data Fiduciary or intermediary, to furnish information it needs for the purposes of the Act.
Binding directions in specified circumstancesThis is the 'blocking' power, and it is a measure of last resort.
How the Act sits alongside other legislationThis positions the Act among India's other laws.
Civil courts barred from matters the Board decidesThis keeps data-protection disputes with the Board rather than the ordinary courts.
The basis for the DPDP Rules, 2025The Act sets the framework and deliberately leaves the operational detail to delegated rules.
Rules and notifications placed before ParliamentThis is a parliamentary check on delegated law.
The Government may amend the penalty ScheduleThis lets the Central Government update the penalty Schedule by notification - but with a guardrail: it cannot raise any penalty to more than twice the amount originally enacted.
Removing difficulties in giving effect to the ActThis is a transitional safety valve.
Consequential changes to other legislationThis final section tidies up the wider statute book to fit the new law.
From a free DPDP risk check to a board-ready roadmap, Anix TrustStack helps you manage AI and DPDP together - securely and sustainably.