What is it?
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive law on the processing of digital personal data. It establishes a Data Protection Board of India, defines Data Fiduciaries (controllers) and Data Principals (data subjects), and applies extra-territorially when offering goods/services to people in India.
Lawful processing — consent + legitimate uses
Processing must be on the basis of consent (free, specific, informed, unconditional, unambiguous, withdrawable, signaled by a clear affirmative action) or for specified legitimate uses (employment, medical emergency, court/tribunal orders, etc.).
Data Principal rights
- Right to access information about processing.
- Right to correction and erasure.
- Right to grievance redressal — Data Fiduciary must publish contact details and respond within a specified period (rules expected to set 30 days).
- Right to nominate.
Data Fiduciary obligations
Reasonable security safeguards, breach notification to the Board and affected individuals, processing only for the specified purpose, data minimisation, retention limited to the purpose, and accuracy of personal data used for decisions.
Significant Data Fiduciaries
The Central Government may notify Significant Data Fiduciaries (SDFs) based on volume, sensitivity, or risk. SDFs must appoint a Data Protection Officer based in India, conduct periodic DPIAs and audits, and adopt other enhanced measures.
Penalties
Up to ₹250 crore per instance (the maximum, for security-safeguard failures), with tiered penalties for breaches of children's data, breach of duties to children, failure to notify a personal-data breach, and others. The Board adjudicates.
How iCompaas helps
iCompaas provides DPDP-mapped policies (notice templates per language, consent flows, withdrawal handling), grievance redressal workflow with SLA tracking, retention schedules, and a breach notification playbook for the Data Protection Board reporting format.