The Digital Personal Data Protection Act, 2023.
Administered Ministry: Ministry of Electronics and Information Technology
Act details
| Short title | The Digital Personal Data Protection Act, 2023. |
|---|---|
| Long title | An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto. |
| Act number | 22 of 2023 |
| Act year | 2023 |
| Enactment date | 11 Aug 2023 |
| Ministry | Ministry of Electronics and Information Technology |
| Jurisdiction | Central (Parliament of India) |
| Sections | 44 |
| Schedules | 1 |
| Status | Not repealed |
| Last checked on India Code | 28 Oct 2026 |
| Source | India Code, Government of India |
Summary
Summary of The Digital Personal Data Protection Act, 2023
Scope and Application
• Applies to digital personal data in India and for Indians abroad.
• Exemptions for personal use, publicly available data, and legal requirements.
Key Roles
• Data Principal: The individual.
• Data Fiduciary: Controls data processing.
• Data Processor: Acts on behalf of the Fiduciary.
Fiduciary Duties
• Legitimate Processing: Consent or lawful uses.
• Transparent Notice: Informing principals.
• Secure Processing: Implementing safeguards.
Principal's Rights
• Access and Transparency
• Correction and Deletion
• Grievance Mechanism
Governance
• Data Protection Board: Oversight.
• Tribunal: Appeals.
• (Penalties and Detailed Governance: Refer Full Act)
Action Consult the full Act for detailed penalties, exemptions, and governance.
Legislative history
Legislative History:
The Digital Personal Data Protection Act, 2023
Source: Official Record of Parliament, India Code, and Ministry of Electronics and Information Technology
Act Title - The Digital Personal Data Protection Act, 2023
Act Number - Act No. 22 of 2023
Act ID (India Code) - 202322
Presidential Assent date - August 11, 2023
Enforcement Date - August 11, 2023
Nodal Ministry - Ministry of Electronics and Information Technology
Precedent & Historical Rationale
● First Comprehensive Data Privacy Framework: Establishes India’s first dedicated, primary statutory regime for the processing of digital personal data, giving legislative form to the fundamental right to privacy affirmed in K.S. Puttaswamy v. Union of India (2017).
● Data Fiduciaries & Data Principals: Outlines clear legal grounds for processing personal data (based on consent or "certain legitimate uses"), defines rights and duties of individuals (Data Principals), and establishes strict obligations for processing entities (Data Fiduciaries and Significant Data Fiduciaries).
● Establishment of DPBI & Penalty Structure: Creates the Data Protection Board of India (DPBI) as an adjudicatory body to investigate breaches and impose statutory penalties of up to ₹250 crore per instance, replacing criminal penalties with civil monetary adjudications.
Parliamentary Trajectory & Enactment
● Formulation: Emerging from years of drafting rounds (including the Srikrishna Committee report, the Personal Data Protection Bill, 2019, and subsequent withdrawals), it was introduced as the Digital Personal Data Protection Bill, 2023 by the Union Minister of Electronics and IT, Shri Ashwini Vaishnaw.
● Parliamentary Passage: Introduced in the Lok Sabha on August 3, 2023; passed by the Lok Sabha on August 7, 2023; and passed by the Rajya Sabha on August 9, 2023.
● Presidential Assent: Received the assent of the President of India on August 11, 2023.
● Enforcement: Enforced on August 11, 2023.