Digital Personal Data Protection Act, 2023

Act No. 22 of 2023 Presidential assent: 11 August 2023 Updated for DPDP Rules, 2025

The Digital Personal Data Protection Act, 2023 (DPDP Act) governs the processing of digital personal data in India. It seeks to balance the right of individuals to protect their personal data with the need to process such data for lawful purposes.

Current commencement status

The Central Government notified a staggered commencement of the Act on 13 November 2025. As of 4 September 2026:

  • In force: section 1(2), section 2, sections 18-26, sections 35 and 38-43, and section 44(1) and 44(3).
  • Scheduled from 13 November 2026: section 6(9) and section 27(1)(d).
  • Scheduled from 13 May 2027: sections 3-5, most of section 6, sections 7-17, most of section 27, sections 28-34, sections 36-37 and section 44(2).

The Digital Personal Data Protection Rules, 2025 were notified with a similar phased commencement. Rules 1, 2 and 17-21 are in force; Rule 4 is scheduled one year after publication, and Rules 3, 5-16, 22 and 23 eighteen months after publication.

Section 1 - Short title and commencement

(1) This Act may be called the Digital Personal Data Protection Act, 2023.

(2) It comes into force on dates appointed by the Central Government by notification in the Official Gazette, and different dates may be appointed for different provisions.

DPDP Act, 2023 - Chapter and section index

Use the links below to open the detailed section pages on this website.

CHAPTER I - PRELIMINARY

CHAPTER II - OBLIGATIONS OF DATA FIDUCIARY

CHAPTER III - RIGHTS AND DUTIES OF DATA PRINCIPAL

CHAPTER IV - SPECIAL PROVISIONS

CHAPTER V - DATA PROTECTION BOARD OF INDIA

CHAPTER VI - POWERS, FUNCTIONS AND PROCEDURE TO BE FOLLOWED BY BOARD

CHAPTER VII - APPEAL AND ALTERNATE DISPUTE RESOLUTION

CHAPTER VIII - PENALTIES AND ADJUDICATION

CHAPTER IX - MISCELLANEOUS