What does the Digital Personal Data Protection Act, 2023 require?
The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India, and of personal data processed outside India in connection with offering goods or services to people in India. A business that decides why and how personal data is processed (a “data fiduciary”) must process it only for a lawful purpose, on the basis of consent or a specified legitimate use; give a clear notice; keep reasonable security safeguards; report personal data breaches to the Data Protection Board and to the individuals affected; and respond to requests for access, correction and erasure. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and most obligations take effect eighteen months later, in May 2027.
The Act and the Rules call for changes to contracts, systems and internal processes for any business that handles customer, employee, patient or research data in India, and our data protection lawyers advise on each of them. Penalties can reach ₹250 crore for a single breach.
The practice is led jointly by Mr. Vikas Kumar and Mr. Abhinav Gupta. It draws on Mr. Gupta’s experience of the pharmaceutical and life-sciences sector, where patient data, clinical-trial data and cross-border research collaborations raise particular questions.
What the practice covers
- Readiness for the DPDP Act: data mapping, gap assessments and compliance plans against the Act and the 2025 Rules
- Privacy notices, consent flows and arrangements with consent managers
- Data processing, data sharing and cross-border transfer agreements with group companies, vendors and research partners
- Health, pharmaceutical and clinical-trial data, including the interplay with the New Drugs and Clinical Trials Rules, 2019
- Personal data breach response, notifications to the Data Protection Board and affected individuals, and internal investigations
- Advice to foreign businesses on the reach of the DPDP Act and its interaction with the EU GDPR and other foreign laws
- Proceedings before the Data Protection Board and appeals to the Telecom Disputes Settlement and Appellate Tribunal
- Obligations under the Information Technology Act, 2000, including CERT-In cyber incident reporting
Common questions
Does the DPDP Act apply to a company outside India?
Yes, where it processes digital personal data outside India in connection with any activity related to offering goods or services to individuals in India (Section 3(b)).
When do the obligations take effect?
The provisions on the Data Protection Board took effect when the Rules were notified on 13 November 2025. Registration of consent managers applies from 13 November 2026, twelve months after notification. The main obligations of data fiduciaries, including notice, consent, security safeguards, breach reporting and the rights of individuals, take effect eighteen months after notification, in May 2027.
Can personal data be transferred outside India?
Yes. The Act allows transfers to any country unless the Central Government restricts transfers to that country by notification. Sector-specific rules, such as those of the Reserve Bank of India on payment data, may impose stricter localisation requirements, and the Rules allow the Government to set conditions for transfers in particular cases.
What is a Significant Data Fiduciary?
A data fiduciary notified by the Central Government on the basis of factors such as the volume and sensitivity of the data it processes. It must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic data protection impact assessments (Section 10).
What are the penalties?
The Data Protection Board may impose penalties set out in the Schedule to the Act: up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify a breach or to meet the obligations relating to children’s data.