india-dpdp-act
India DPDP Act 2023 Compliance
Overview
The Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent on 11 August 2023 and was notified in the Gazette of India as Act No. 22 of 2023. The DPDP Act establishes India's first comprehensive personal data protection framework, replacing the data protection provisions of the Information Technology Act, 2000 (Section 43A and the Sensitive Personal Data or Information Rules, 2011). The Act applies to digital personal data processing within India and to processing outside India if it involves offering goods or services to data principals in India (Section 3).
The Data Protection Board of India (DPBI) is established under Section 18 as the adjudicatory body for enforcement. The Central Government retains rule-making authority under Section 40 to prescribe detailed implementing rules.
Status as of March 2026: The Central Government has published draft DPDP Rules for public consultation. Several provisions await final notification of the rules for full operationalisation.