India's landmark legal framework enacted by the Parliament of India to govern the processing of digital personal data, recognizing individual privacy rights and establishing institutional obligations.
Click on any chapter below to view its section-by-section statutory provisions, legal commentary, and compliance guidance.
Short title, extent, commencement, and foundational scope of the Act.
Core compliance obligations including notice, consent, and children data safeguards.
Data principal rights such as access, correction, erasure, grievance, and nomination.
Cross-border and exemption-related provisions under the Act.
Board establishment, composition, offices, and institutional structure.
How the Board operates, investigates, and discharges its functions.
Appeals, enforceability, and alternate dispute resolution under DPDPA.
Penalty framework and the crediting of realised sums.
Residual powers, rule-making, consistency, and amendment provisions.
The Digital Personal Data Protection Act is anchored on seven foundational privacy principles governing personal data processing in India:
Personal data must be processed only for lawful purposes with valid consent or legitimate statutory uses.
Data must be collected and used strictly for the specific purpose disclosed in the privacy notice.
Only the personal data strictly necessary for the stated purpose may be collected and processed.
Reasonable efforts must be taken to ensure personal data is accurate, consistent, and updated.
Personal data must not be retained once the purpose of collection has been served or consent withdrawn.
Reasonable technical and organizational security safeguards must be instituted to prevent data breaches.
Data Fiduciaries remain legally accountable for compliance even when engaging third-party Data Processors.
Guaranteed rights of access, correction, erasure, grievance redressal, and nomination.
Monetary penalties adjudicable by the Data Protection Board of India under Section 33 of the Act:
| Item | Breach / Violation Category | Maximum Penalty |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach [Section 8(5)] | Up to ₹250 Crore |
| 2. | Failure to notify the Data Protection Board of India and affected Data Principals in the event of a personal data breach [Section 8(6)] | Up to ₹200 Crore |
| 3. | Breach in observance of additional obligations in relation to children and persons with disabilities [Section 9] | Up to ₹200 Crore |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary [Section 10] | Up to ₹150 Crore |
| 5. | Breach in observance of duties by Data Principal [Section 15] | Up to ₹10,000 |
| 6. | Breach of any other provision of this Act or the rules made thereunder | Up to ₹50 Crore |