# India's Digital Personal Data Protection Act 2023 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_dpdp-indias-digital-personal-data-protection-act-2023-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DPDP Act (India)](https://support.icompaas.com/support/solutions/c_gen_dpdpa) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_cgendpdpa_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act, 2023 · Government of India

### What is it?

The **Digital Personal Data Protection Act, 2023** (DPDP Act) is India's first comprehensive law on the processing of digital personal data. It establishes a **Data Protection Board of India**, defines **Data Fiduciaries** (controllers) and **Data Principals** (data subjects), and applies _extra-territorially_ when offering goods/services to people in India.

### Lawful processing — consent + legitimate uses

Processing must be on the basis of **consent** (free, specific, informed, unconditional, unambiguous, withdrawable, signaled by a clear affirmative action) or for specified **legitimate uses** (employment, medical emergency, court/tribunal orders, etc.).

### Data Principal rights

-   Right to access information about processing.
-   Right to correction and erasure.
-   Right to grievance redressal — Data Fiduciary must publish contact details and respond within a specified period (rules expected to set 30 days).
-   Right to nominate.

### Data Fiduciary obligations

Reasonable security safeguards, breach notification to the Board and affected individuals, processing only for the specified purpose, data minimisation, retention limited to the purpose, and accuracy of personal data used for decisions.

### Significant Data Fiduciaries

The Central Government may notify **Significant Data Fiduciaries (SDFs)** based on volume, sensitivity, or risk. SDFs must appoint a **Data Protection Officer based in India**, conduct **periodic DPIAs** and **audits**, and adopt other enhanced measures.

### Penalties

Up to **₹250 crore** per instance (the maximum, for security-safeguard failures), with tiered penalties for breaches of children's data, breach of duties to children, failure to notify a personal-data breach, and others. The Board adjudicates.

### How iCompaas helps

iCompaas provides DPDP-mapped policies (notice templates per language, consent flows, withdrawal handling), grievance redressal workflow with SLA tracking, retention schedules, and a breach notification playbook for the Data Protection Board reporting format.

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): The DPDP Act and 2025 Rules explained as an implementation plan, including what is in force today.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): A GDPR programme covers most DPDP obligations; the guide shows the overlap and the India-specific gaps.