Act 22 of 2023 · India · Primary text with plain-English notes
Digital Personal Data Protection Act, 2023
India's data protection law: 44 sections in 9 chapters and a Schedule of penalties, coming into force in phases under notification G.S.R. 843(E) of 13 Nov 2025. One page per section, with the statutory text, a plain-English reading, what you must do, and the date each part applies.
Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); Gazette of India, Act No. 22 of 2023, as updated to 19 Nov 2025 (India Code); DPDP Rules, 2025, G.S.R. 846(E), 13 Nov 2025; Commencement notification G.S.R. 843(E), 13 Nov 2025 · Change log
- Status
- In force in part
- Fully applies
- 13 May 2027G.S.R. 843(E)
- Highest penalty
- Up to Rs 250 croreSchedule, item 1
- Binds
- Every Data Fiduciary the Act reaches (s. 3)
Countdown · Every remaining section
190days
to 13 May 2027, when notice, consent, security, breach intimation, rights and the penalties all apply.
Consent Manager registration opens first, on 13 Nov 2026: 9 days from today.
Get ready with InfofacilityKey dates
- 11 Aug 2023In force
The Act receives the President's assent and is published in the Gazette. Sections come into force on the dates the Central Government notifies under s. 1(2).
Act 22 of 2023, s. 1(2) - 13 Nov 2025In force
G.S.R. 843(E) brings sections 2, 18 to 26, 35 and 38 to 43 into force at once, and G.S.R. 846(E) notifies the DPDP Rules, 2025. The Data Protection Board of India is established by G.S.R. 844(E) the same day.
G.S.R. 843(E); G.S.R. 844(E); G.S.R. 846(E) - 13 Nov 2026Upcoming
Section 6(9) and section 27(1)(d), the Consent Manager provisions, come into force 12 months after notification, with Rule 4 on registration of Consent Managers.
G.S.R. 843(E); DPDP Rules 2025, Rule 1(3) - 13 May 2027Upcoming
Every remaining section applies 18 months after notification: s. 3 to 5, s. 6 except sub-section (9), s. 7 to 17, s. 27 (except clause (1)(d)) to 34, s. 36 and 37, and s. 44(2). Notices, consent, security safeguards, breach intimation, erasure, rights requests, Significant Data Fiduciary duties and the penalties all become enforceable.
G.S.R. 843(E); DPDP Rules 2025, Rule 1(4)
Commencement dates follow the footnote to s. 1(2) in the India Code text as updated to 19 Nov 2025, which cites G.S.R. 843(E). The 12-month and 18-month dates are counted from 13 Nov 2025.
Who it applies to
In plain English
The Act covers digital personal data processed in India, whether it was collected digitally or on paper and digitised later, and processing outside India when it is connected with offering goods or services to people in India. It does not cover data a person has made public themselves or data processed for personal or domestic purposes. The company or person who decides why and how data is processed is the Data Fiduciary, and the duties fall on it.
Source: DPDP Act 2023, s. 3
Chapters and sections
Preliminary
s. 1 to 3
Obligations of Data Fiduciary
s. 4 to 10
Rights and duties of Data Principal
s. 11 to 15
Special provisions
s. 16 and 17
Data Protection Board of India
s. 18 to 26
Powers, functions and procedure to be followed by Board
s. 27 and 28
Appeal and alternate dispute resolution
s. 29 to 32
Penalties and adjudication
s. 33 and 34
Miscellaneous
s. 35 to 44
The Schedule: penalties
The maximum penalty for each breach of the Act, up to Rs 250 crore for failing to take reasonable security safeguards.
Status follows the commencement notification under s. 1(2). Each section page carries its own date and source.
Most read sections
General obligations of Data Fiduciary
Upcoming · 13 May 2027s. 6Consent
Upcoming · 13 May 2027s. 7Certain legitimate uses
Upcoming · 13 May 2027s. 10Additional obligations of Significant Data Fiduciary
Upcoming · 13 May 2027Sch.The Schedule: penalties
Upcoming · 13 May 2027s. 9Processing of personal data of children
Upcoming · 13 May 2027Read it with
Change log
- 4 Nov 2026 First version. Section titles and commencement dates taken from the India Code text as updated to 19 Nov 2025 and its footnote citing G.S.R. 843(E). Statutory text pending word-for-word verification.
- 4 Nov 2026 Statutory text of every section and the Schedule added from the Gazette of India PDF (Act No. 22 of 2023, 11 Aug 2023, MeitY copy) by automated extraction, with sections 1 to 3, 7 to 9, 17, 44 and the Schedule read against the PDF. A full word-for-word read-through of the remaining sections is the next check.
- 4 Nov 2026 Rule references corrected to the numbering in G.S.R. 846(E) (Significant Data Fiduciaries are Rule 13, rights Rule 14, transfers Rule 15, research Rule 16, children's exemptions Rule 12) and linked to the Rules pages.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators