What is the DPDP Act 2023?
India's comprehensive personal-data-protection law, in plain terms — who it applies to, what it requires, and what a breach can cost.
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law governing how organizations collect, process, and store the personal data of individuals in India. It requires consent or a defined "legitimate use" for processing, reasonable security safeguards, breach notification, and can penalize a data breach caused by inadequate safeguards up to ₹250 crore per instance.
Last updated:
The definition
The DPDP Act received presidential assent in August 2023 and is India's first standalone data protection statute. It defines a Data Fiduciary — the organization that decides why and how personal data is processed — and a Data Principal, the individual the data is about. Most of what the Act asks of a Data Fiduciary maps directly onto controls a security team already recognizes: get a lawful basis before processing, collect only what's needed, secure it, and say something when it goes wrong.
Who it applies to
Broader than most first assume.
Any processing of Indian residents' data
It applies to digital personal data processed within India, and to processing outside India if it relates to offering goods or services to individuals in India. Sector, company size, and whether the processing is manual or automated don't exempt an organization on their own.
Enforced by the Data Protection Board
The Act establishes the Data Protection Board of India to investigate complaints, order remedial action, and impose penalties. Several operational details are set out in subordinate rules, which have moved through public consultation since the Act's assent — check MeitY's own publications for the current status before treating any specific compliance date as final.
What it requires
The obligations that matter most for a security or IT team.
- Consent, or a defined “legitimate use,” before processing personal data — and a consent request has to be as easy to withdraw as it was to give.
- Data minimization: collect what the stated purpose actually needs, not what might be useful someday.
- Reasonable security safeguards to prevent a personal data breach — the Act doesn't prescribe a specific technical standard, but “reasonable” is judged after the fact.
- Breach notification to both the Data Protection Board and the affected individuals.
- Data Principal rights: access, correction, erasure, grievance redressal, and the right to nominate someone to exercise these rights after death or incapacity.
What a breach can cost
The Act's Schedule sets penalties per category of violation. The highest tier — up to ₹250 crore — attaches to a personal data breach caused by a failure to take reasonable security safeguards. Lower tiers apply to other violations, such as failing to notify a breach or failing to fulfil obligations toward children's data. These are ceilings the Board can impose per instance, not fixed fines, and the Board sets the actual amount based on the violation's nature and impact.
What this means for AI tools
An employee pasting a customer's name, phone number, or account details into ChatGPT is processing personal data outside any consent that customer gave — and outside any security safeguard the organization's DLP or CASB was built to enforce, because neither was built to read a chat window. Detecting that at the point it happens, before the prompt leaves the browser, is the specific gap PromptSec is built to close.
The mechanics of the ₹250 crore ceiling — what specifically triggers it, and how "reasonable" gets judged — are in a closer look at the Act's penalty schedule.
Find out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days