[{"data":1,"prerenderedAt":342},["ShallowReactive",2],{"dpdp-\u002Fdpdp-act\u002Fwhat-is-dpdp-act":3},{"id":4,"title":5,"author":6,"body":7,"category":305,"date":306,"description":307,"draft":308,"extension":309,"eyebrow":310,"faq":311,"h1":321,"keywords":322,"meta":326,"navigation":327,"ogTitle":328,"path":329,"readingTime":330,"relatedArticles":331,"relatedServices":334,"seo":337,"stem":338,"tags":339,"updated":340,"__hash__":341},"dpdp\u002Fdpdp-act\u002Fwhat-is-dpdp-act.md","What Is the DPDP Act, 2023? A Plain Guide","DreamyHook Consultancy Services",{"type":8,"value":9,"toc":293},"minimark",[10,19,22,27,42,53,57,101,105,116,119,123,130,183,187,190,217,221,233,237,240,279,287],[11,12,13,14,18],"p",{},"India's ",[15,16,17],"strong",{},"Digital Personal Data Protection Act, 2023"," (the \"DPDP Act\") is the country's first comprehensive law dedicated to protecting personal data. If your organization collects, stores, or uses the personal data of people in India — and almost every modern business does — this law now governs how you must do it.",[11,20,21],{},"This guide explains the Act in plain language: what it is, who it covers, what it asks of you, and where to start.",[23,24,26],"h2",{"id":25},"what-the-dpdp-act-is-in-one-sentence","What the DPDP Act is, in one sentence",[11,28,29,30,33,34,37,38,41],{},"The DPDP Act sets the rules for how organizations may handle the ",[15,31,32],{},"digital personal data"," of individuals in India, gives individuals enforceable ",[15,35,36],{},"rights"," over their data, and creates a regulator — the ",[15,39,40],{},"Data Protection Board of India"," — to enforce it all.",[11,43,44,45,48,49,52],{},"It received Presidential assent on ",[15,46,47],{},"11 August 2023",". The detailed operational requirements come through the ",[15,50,51],{},"DPDP Rules",", which are being rolled out on a phased timeline.",[23,54,56],{"id":55},"the-key-players-in-the-acts-language","The key players (in the Act's language)",[58,59,60,67,78,84,95],"ul",{},[61,62,63,66],"li",{},[15,64,65],{},"Data Principal"," — the individual the personal data is about (you, your customers, your users).",[61,68,69,72,73,77],{},[15,70,71],{},"Data Fiduciary"," — the organization that decides why and how personal data is processed. This is probably ",[74,75,76],"em",{},"you",".",[61,79,80,83],{},[15,81,82],{},"Data Processor"," — anyone who processes personal data on behalf of a Data Fiduciary (your vendors and tools).",[61,85,86,89,90,77],{},[15,87,88],{},"Significant Data Fiduciary (SDF)"," — a higher-risk Data Fiduciary, notified by the government, with extra duties. ",[91,92,94],"a",{"href":93},"\u002Fdpdp-act\u002Fsignificant-data-fiduciary","Learn more about SDFs",[61,96,97,100],{},[15,98,99],{},"Consent Manager"," — a new, registered intermediary that lets people manage their consents in one place.",[23,102,104],{"id":103},"who-has-to-comply","Who has to comply",[11,106,107,108,111,112,115],{},"Practically every organization that processes the digital personal data of people in India. The Act applies to processing ",[15,109,110],{},"within India",", and also to processing ",[15,113,114],{},"outside India"," where it relates to offering goods or services to people in India.",[11,117,118],{},"It covers data collected digitally, and non-digital data that is later digitized. Purely personal or domestic use is excluded, and certain government processing has specific treatment.",[23,120,122],{"id":121},"what-the-act-requires-of-you","What the Act requires of you",[11,124,125,126,129],{},"At its heart, the DPDP Act asks you to process personal data ",[15,127,128],{},"lawfully, for clear purposes, with consent (or another permitted ground), and no more than you need",". In practice that means:",[58,131,132,143,149,155,161,171,177],{},[61,133,134,137,138,142],{},[15,135,136],{},"Notice & consent."," Tell people clearly what you collect and why, and obtain consent that is free, specific, informed, unconditional, and unambiguous — with withdrawal as easy as giving it. (We build this in our ",[91,139,141],{"href":140},"\u002Fservices\u002Fconsent-management","Consent Management service",".)",[61,144,145,148],{},[15,146,147],{},"Purpose limitation & minimization."," Collect only what you need, and only use it for the purpose you stated.",[61,150,151,154],{},[15,152,153],{},"Accuracy & retention limits."," Keep data accurate, and delete it when the purpose is served.",[61,156,157,160],{},[15,158,159],{},"Security safeguards."," Protect data with reasonable technical and organizational measures.",[61,162,163,166,167,142],{},[15,164,165],{},"Honor Data Principal rights."," Provide access, correction, erasure, grievance redressal, and nomination. (See ",[91,168,170],{"href":169},"\u002Fservices\u002Fdata-principal-rights","Data Principal Rights Automation",[61,172,173,176],{},[15,174,175],{},"Breach notification."," Notify the Data Protection Board and affected individuals if a personal data breach occurs.",[61,178,179,182],{},[15,180,181],{},"Children's data."," Obtain verifiable parental consent for under-18s and avoid tracking or targeting them.",[23,184,186],{"id":185},"rights-of-the-data-principal","Rights of the Data Principal",[11,188,189],{},"The Act gives individuals the right to:",[191,192,193,199,205,211],"ol",{},[61,194,195,198],{},[15,196,197],{},"Access"," a summary of their personal data and who it has been shared with.",[61,200,201,204],{},[15,202,203],{},"Correction, completion, updating, and erasure"," of their data.",[61,206,207,210],{},[15,208,209],{},"Grievance redressal"," through a readily available mechanism.",[61,212,213,216],{},[15,214,215],{},"Nomination"," of another person to exercise their rights in case of death or incapacity.",[23,218,220],{"id":219},"penalties","Penalties",[11,222,223,224,227,228,232],{},"The Data Protection Board can impose significant financial penalties — up to ",[15,225,226],{},"₹250 crore"," for certain failures (for example, inadequate security safeguards leading to a breach). Penalties are decided after due process and are graded to the nature and gravity of the breach. See ",[91,229,231],{"href":230},"\u002Fdpdp-act\u002Fpenalties","Penalties & Enforcement"," for the detail.",[23,234,236],{"id":235},"how-to-actually-comply","How to actually comply",[11,238,239],{},"Reading the law is the easy part. The hard part is making your systems match it. A sensible sequence:",[191,241,242,253,264],{},[61,243,244,247,248,252],{},[15,245,246],{},"Find out where you stand"," with a ",[91,249,251],{"href":250},"\u002Fservices\u002Freadiness-audit","readiness audit"," — map your data and your gaps.",[61,254,255,258,259,263],{},[15,256,257],{},"Fix the gaps"," through ",[91,260,262],{"href":261},"\u002Fservices\u002Ftechnical-implementation","technical implementation"," — consent, rights, retention, security.",[61,265,266,269,270,274,275,77],{},[15,267,268],{},"Stay compliant"," with ",[91,271,273],{"href":272},"\u002Fservices\u002Fmanaged-compliance","managed compliance"," and, where needed, a ",[91,276,278],{"href":277},"\u002Fservices\u002Fdpo-as-a-service","DPO",[11,280,281,282,286],{},"The fastest way to see your own position is our free ",[91,283,285],{"href":284},"\u002Fquick-scan","DPDP Quick Scan"," — five minutes for an instant readiness snapshot.",[288,289,290],"blockquote",{},[11,291,292],{},"This guide is general information about the DPDP Act, 2023, not legal advice. Confirm specifics against the official notified text or with a qualified lawyer.",{"title":294,"searchDepth":295,"depth":295,"links":296},"",3,[297,299,300,301,302,303,304],{"id":25,"depth":298,"text":26},2,{"id":55,"depth":298,"text":56},{"id":103,"depth":298,"text":104},{"id":121,"depth":298,"text":122},{"id":185,"depth":298,"text":186},{"id":219,"depth":298,"text":220},{"id":235,"depth":298,"text":236},"Fundamentals","2026-02-10","A plain-English guide to India's Digital Personal Data Protection Act, 2023 — what it is, who it covers, what it requires, and how to comply.",false,"md","Cornerstone guide",[312,315,318],{"q":313,"a":314},"When was the DPDP Act passed?","The Digital Personal Data Protection Act was passed by Parliament and received Presidential assent on 11 August 2023. Its provisions are being brought into force in phases through the DPDP Rules.",{"q":316,"a":317},"Does the DPDP Act apply to small businesses?","Yes. The Act applies to almost any organization that processes the digital personal data of people in India, regardless of size. Some obligations are lighter for smaller players, but the core duties apply broadly.",{"q":319,"a":320},"What is the penalty for non-compliance?","Financial penalties can reach up to ₹250 crore for certain breaches, imposed by the Data Protection Board of India after due process.","What is the DPDP Act, 2023? A plain-English guide",[323,324,325],"DPDP Act 2023","Digital Personal Data Protection Act","DPDP compliance India",{},true,null,"\u002Fdpdp-act\u002Fwhat-is-dpdp-act","9 min read",[332,333],"\u002Fdpdp-act\u002Fdpdp-rules-2025","\u002Fdpdp-act\u002Fcompliance-checklist",[335,336],"readiness-audit","technical-implementation",{"title":5,"description":307},"dpdp-act\u002Fwhat-is-dpdp-act",[],"2026-05-20","z6HT6wTlr_eXLUkfQmMpIZ4JAHsdf3ze0SeM287H8f8",1780230335764]