The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) provides for the processing of digital personal data in India in a manner that recognises both the right of individuals to protect their personal data and the need to process such data for lawful purposes. It sets out the grounds and conditions for processing personal data, the obligations of Data Fiduciaries, the rights and duties of Data Principals, the constitution and powers of the Data Protection Board of India, provisions for appeal and alternate dispute resolution, penalties for non-compliance, and miscellaneous provisions including consequential amendments to the Telecom Regulatory Authority of India Act, 1997, the Information Technology Act, 2000, and the Right to Information Act, 2005. Received the assent of the President on 11th August, 2023. Substantive provisions notified with effect from 13th November, 2025.
CHAPTER I — PRELIMINARY
CHAPTER II — OBLIGATIONS OF DATA FIDUCIARY
- Section 4 — Grounds for processing personal data
- Section 5 — Notice
- Section 6 — Consent
- Section 7 — Certain legitimate uses
- Section 8 — General obligations of Data Fiduciary
- Section 9 — Processing of personal data of children
- Section 10 — Additional obligations of Significant Data Fiduciary
CHAPTER III — RIGHTS AND DUTIES OF DATA PRINCIPAL
- Section 11 — Right to access information about personal data
- Section 12 — Right to correction and erasure of personal data
- Section 13 — Right of grievance redressal
- Section 14 — Right to nominate
- Section 15 — Duties of Data Principal
CHAPTER IV — SPECIAL PROVISIONS
CHAPTER V — DATA PROTECTION BOARD OF INDIA
- Section 18 — Establishment of Board
- Section 19 — Composition and qualifications for appointment of Chairperson and Members
- Section 20 — Salary, allowances payable to and term of office
- Section 21 — Disqualifications for appointment and continuation as Chairperson and Members of Board
- Section 22 — Resignation by Members and filling of vacancy
- Section 23 — Proceedings of Board
- Section 24 — Officers and employees of Board
- Section 25 — Members and officers to be public servants
- Section 26 — Powers of Chairperson
CHAPTER VI — POWERS, FUNCTIONS AND PROCEDURE TO BE FOLLOWED BY BOARD
CHAPTER VII — APPEAL AND ALTERNATE DISPUTE RESOLUTION
- Section 29 — Appeal to Appellate Tribunal
- Section 30 — Orders passed by Appellate Tribunal to be executable as decree
- Section 31 — Alternate dispute resolution
- Section 32 — Voluntary undertaking
CHAPTER VIII — PENALTIES AND ADJUDICATION
- Section 33 — Penalties
- Section 34 — Crediting sums realised by way of penalties to Consolidated Fund of India
CHAPTER IX — MISCELLANEOUS
- Section 35 — Protection of action taken in good faith
- Section 36 — Power to call for information
- Section 37 — Power of Central Government to issue directions
- Section 38 — Consistency with other laws
- Section 39 — Bar of jurisdiction
- Section 40 — Power to make rules
- Section 41 — Laying of rules and certain notifications
- Section 42 — Power to amend Schedule
- Section 43 — Power to remove difficulties
- Section 44 — Amendments to certain Acts
THE SCHEDULE
Note: The Digital Personal Data Protection Act, 2023 was passed by the Lok Sabha on 7th August 2023 and the Rajya Sabha on 9th August 2023, and received the assent of the President on 11th August, 2023. Sections 2, 18 to 26, 35 to 43, and sub-sections (1) and (3) of section 44 were brought into force with effect from 13th November, 2025. Section 44 makes consequential amendments to the Telecom Regulatory Authority of India Act, 1997, the Information Technology Act, 2000 (including omission of section 43A), and the Right to Information Act, 2005. This site’s build-out is now complete across all nine Chapters and the Schedule — all 44 sections are live.
