With the backstory covered, it’s time to meet the Act itself — not section by section, but in plain terms. Here’s what it actually is.
QUICK FACTS
PASSED
11 August 2023
Full name: the Digital Personal Data Protection Act, 2023.
APPLIES TO
Digital personal data
Data about an identifiable person, in digital form — collected online or digitised afterward.
ENFORCED BY
Data Protection Board of India
A dedicated body set up under the Act to hear complaints and impose penalties.
The Act’s purpose is narrower and more practical than it sounds: process personal data in a way that respects a person’s right to protect it, while still allowing organisations to use that data for lawful purposes. It isn’t trying to stop data from moving. It’s trying to set the terms it moves on.
Common misconception — That the Act bans companies from using personal data. It doesn’t — it sets the conditions under which they can: consent, or one of a fixed set of lawful exceptions covered later in this module.
The DPDP Act exists to keep data flowing — just on terms people can actually trust.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf