Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

The DPDP Act, explained

India’s Digital Personal Data Protection Act, 2023 – all nine chapters and 44 sections, each translated into plain language with the statutory citation underneath. Switch views to see only what applies to you.

These are plain-language summaries for orientation – not the legal text and not legal advice. Each section links to its full page and primary source.

1The basicsEveryoneWhat the law is called, the terms it uses, and who it applies to.

Chapter I: Preliminary (Sections 1 to 3)

Ch 1 · Preliminary · Sections 1–3
S1Short title and commencementThe Act’s name, and that it starts on dates the government notifies in phases.S2DefinitionsThe key terms – Data Principal, Data Fiduciary, personal data, processing, consent.S3Application of the ActCovers digital personal data in India, and firms abroad serving people in India.›Chapter I overview: applicability and scopeHow Sections 1 to 3 fit together, plus commencement status.
2What businesses must doBusinessesThe core duties of any organisation that collects personal data.

Chapter II: Obligations of Data Fiduciary (Sections 4 to 10)

Ch 2 · Obligations of Data Fiduciary · Sections 4–10
S4Grounds for processingYou may process personal data only with consent or a defined legitimate use.S5NoticeGive a clear notice of what data you take, why, and how to complain or withdraw.S6ConsentConsent must be free, specific, informed, unambiguous, and easy to withdraw.S7Certain legitimate usesThe specific cases you can process without consent – e.g. emergencies, employment.S8General obligationsAccuracy, security safeguards, breach reporting, erasure, and a grievance channel.S9Children’s dataVerifiable parental consent; no tracking or targeted ads to under-18s.S10Significant Data FiduciaryExtra duties – DPO, audits, impact assessments – for high-risk fiduciaries.
3Your rightsIndividualsWhat you can ask companies to do with your personal data.

Chapter III: Rights and Duties of Data Principal (Sections 11 to 15)

Ch 3 · Rights and Duties of Data Principal · Sections 11–15
S11Right to access informationGet a summary of your data being processed and who it’s shared with.S12Right to correction and erasureFix or delete your personal data.S13Right of grievance redressalAn easy, available way to raise a complaint with the fiduciary.S14Right to nominateName someone to exercise your rights if you die or can’t act.S15Duties of Data PrincipalDon’t file false complaints or impersonate others.
4Special casesBusinessesCross-border transfers, and where the Act doesn’t apply.

Chapter IV: Special Provisions (Sections 16 to 17)

Ch 4 · Special Provisions · Sections 16–17
S16Processing outside IndiaThe government may restrict transfers of personal data to certain countries.S17ExemptionsWhere the Act, or parts of it, don’t apply – e.g. research, legal claims, notified startups.
5The regulatorRegulatorHow the Data Protection Board is set up and staffed.

Chapter V: Data Protection Board of India (Sections 18 to 26)

Ch 5 · Data Protection Board of India · Sections 18–26
S18Establishment of the BoardCreates the Data Protection Board of India.S19Composition and qualificationsWho sits on the Board and the qualifications they need.S20Salary, allowances and termPay and tenure of Board members.S21DisqualificationsGrounds that bar someone from serving on the Board.S22Resignation and vacanciesHow members resign and vacancies are filled.S23Proceedings of the BoardHow the Board conducts its business – digital by design.S24Officers and employeesStaffing of the Board.S25Members and officers as public servantsBoard members and officers count as public servants.S26Powers of the ChairpersonThe Chairperson’s administrative and management powers.
6What the Board can doRegulatorThe Board’s investigation and enforcement powers.

Chapter VI: Powers, Functions and Procedure of Board (Sections 27 to 28)

Ch 6 · Powers, Functions and Procedure of Board · Sections 27–28
S27Powers and functions of the BoardThe Board investigates breaches and directs remedial measures and penalties.S28Procedure to be followedHow the Board handles complaints and inquiries, with civil-court powers.
7AppealsRegulatorChallenging a Board order, and settling disputes.

Chapter VII: Appeal and Alternate Dispute Resolution (Sections 29 to 32)

Ch 7 · Appeal and Alternate Dispute Resolution · Sections 29–32
S29Appeal to Appellate TribunalAppeal a Board order to the Appellate Tribunal (TDSAT).S30Orders executable as a decreeTribunal orders are enforceable like a court decree.S31Alternate dispute resolutionThe Board may refer a complaint to mediation.S32Voluntary undertakingA party can offer a binding undertaking to settle a matter.
8PenaltiesPenaltiesWhat breaking the law costs – up to ₹250 crore.

Chapter VIII: Penalties and Adjudication (Sections 33 to 34)

Ch 8 · Penalties and Adjudication · Sections 33–34
S33PenaltiesFinancial penalties up to ₹250 crore, based on the Schedule.S34Crediting penaltiesPenalties collected go to the Consolidated Fund of India.
9Everything elseEveryoneGood-faith protection, government powers, and rule-making.

Chapter IX: Miscellaneous (Sections 35 to 44)

Ch 9 · Miscellaneous · Sections 35–44
S35Protection of good-faith actionNo legal action for things done in good faith under the Act.S36Power to call for informationGovernment or Board can require information.S37Directions by Central GovernmentPower to issue directions, including blocking access in some cases.S38Consistency with other lawsThe Act adds to, and doesn’t override, other laws.S39Bar of jurisdictionCivil courts can’t hear matters the Board handles.S40Power to make rulesThe Central Government can make rules – the DPDP Rules.S41Laying of rulesRules and notifications are laid before Parliament.S42Power to amend the ScheduleThe government can amend the penalty schedule.S43Power to remove difficultiesThe government can resolve implementation difficulties.S44Amendments to certain ActsConsequential changes to other laws, e.g. the IT Act.
Businesses
If you collect personal data, these are your duties.
What businesses must doCh 2 · S4–10
Special casesCh 4 · S16–17
PenaltiesCh 8 · S33–34
Individuals
Your rights over the data companies hold about you.
Your rightsCh 3 · S11–15
The regulator
Who enforces the Act, and how appeals work.
The regulatorCh 5 · S18–26
What the Board can doCh 6 · S27–28
AppealsCh 7 · S29–32
Foundations
The scope, definitions, and machinery behind the law.
The basicsCh 1 · S1–3
Everything elseCh 9 · S35–44
The Schedule
Penalty table – see s.33(1)Sections → Rules
How the Act maps to the 2025 Rules