The basics: India's data law in 5 minutes

Passed is not the same as in force

LAW The Act received assent on 11 Aug 2023. But s.1(2) says it starts on dates the Government notifies. G.S.R. 843(E) starts some provisions on publication, others after one year, and most after eighteen months. Assent did not start every duty.

In force is not the same as ready to enforce

The Board provisions have commenced. We have not confirmed current member appointments. That gap does not suspend law already in force.

Act s.1(2), p.1; G.S.R. 843(E)(a)–(c), p.2; Rule 1(2)–(4), Rules p.24.

What counts as personal data?

LAW · s.2(t), Act p.3: use this test, not a fixed list. Is it about a person? Can you identify that person from it or in relation to it?

OUR READING names, photos, marks and health records usually count when they point to a real person.

LAW · s.3(a), (b), Act pp.3–4: digital records and paper records later made digital are covered. Work abroad is covered when linked to offering goods or services to people in India.

Who is who?

Personal data

Information about a person you can identify from it or in relation to it. LAW · s.2(t) · Act p.3

Data

Information, facts, concepts, opinions or instructions that people or machines can read. LAW · s.2(h) · Act p.2

Data Principal

The person the data is about. For a child, this includes parents or a lawful guardian. For a person with disability, it includes her lawful guardian acting for her where she has one. LAW · s.2(j) · Act p.2

Data Fiduciary

The person or body that decides why and how personal data is used. The boss. LAW · s.2(i), (s) · Act pp.2–3

Data Processor

The person who handles personal data on behalf of the boss. The helper. LAW · s.2(k) · Act p.2

Child

A person who has not completed eighteen years. LAW · s.2(f) · Act p.2

Digital personal data

Personal data in digital form. LAW · s.2(n) · Act p.2

Processing

A wholly or partly automated use of digital personal data. It includes collecting, storing, sharing and erasing. LAW · s.2(x) · Act p.3

Personal data breach

Unauthorised use, or an accident involving data, that harms its secrecy, accuracy or availability. LAW · s.2(u) · Act p.3

Consent Manager

A person registered with the Board who lets people give, manage, review and withdraw consent in one place. LAW · s.2(g) · Act p.2

Data Protection Board

The Data Protection Board of India, established under section 18. LAW · s.2(c); s.18 · Act p.2

Significant Data Fiduciary

A boss or class named by the Government under section 10. It has extra duties. LAW · s.2(z); s.10 · Act p.3

DPIA

A review of risks from using data. A named Significant Data Fiduciary must do one and a data audit each twelve months. LAW · s.10(2)(c); Rule 13(1) · Act p.9; Rules p.29

Names you may hear

• Personal data: The Act’s own term. (s.2(t))
• Digital personal data: Personal data in digital form. (s.2(n))
• PI or PII: Common short forms elsewhere, not defined terms in this Act. (Act definitions, s.2)
• SPDI: A name from the older IT rules. Section 44(2)(a) omits IT Act section 43A at its phased start. (s.44(2)(a); G.S.R. 843(E)(c))

The Act has no ordinary-versus-sensitive class. Sensitivity matters for naming a Significant Data Fiduciary and setting a penalty (s.10(1)(a); s.33(2)(b)).

When may you use data?

LAW · s.4(1), (2), Act p.4: use data for a lawful purpose, with consent or a listed legitimate use. A lawful purpose is one the law does not expressly forbid.

LAW · s.7(a), (d)–(i), Act pp.6–7: listed uses include freely supplied data for a stated purpose without refusal, legal duties, court orders, medical emergencies, public health, disasters and employment. Each has its own scope.

Some State services and State legal functions are listed too (s.7(b), (c); Act pp.6–7). The Act’s telemedicine example excludes phone contacts that the service does not need (s.6(1), illustration; Act p.5).

The seven common steps

These address the Fiduciary. Vendors carry agreed tasks by contract (s.8(1), (2)). Main duties start on the date in the Dates panel (Rule 1(4)).

1. 1. Know your data

   GOOD PRACTICE · Rule 3(b)(i) · Rules p.24

   List the data you hold, why you hold it, where it sits and who sees it. This helps you write a notice.

2. 2. Tell people clearly

   LAW · s.5(1), (3); Rule 3 · Act pp.4–5; Rules pp.24–25

   Give a notice with or before a consent request. It must stand on its own. List the data and purpose, goods, services or uses. Say how to withdraw, use rights and complain. Offer notice access in English or an Eighth Schedule language.

3. 3. Ask properly and allow withdrawal

   LAW · s.6(1), (3), (4), (6), (10); Rule 3(c)(i) · Act pp.5–6; Rules pp.24–25

   Consent must be free, specific, informed, unconditional and unambiguous, through a clear action. Use only the data the purpose needs. Give clear consent requests and a choice of English or an Eighth Schedule language. Include an authorised contact. Withdrawal must be as easy as consent. Stop, and cause vendors to stop, within a reasonable time unless law permits or requires continued use. When consent is questioned in a proceeding, prove the notice and consent.

4. 4. Keep it safe

   LAW · s.8(5); Rule 6(1)(a)–(g) · Rules p.26

   Apply minimum safeguards: data security, access control, logs and review, continuity, retention and vendor-contract terms. Use technical and team measures to make them work. Encryption and masking are examples, not required techniques. Backups are a continuity example. Keep logs and data for detection, investigation, repair and continuity for one year unless law requires otherwise.

5. 5. Be ready for a leak

   LAW · s.8(6); Rule 7(1), (2) · Rules p.26

   At awareness, tell affected people and the Board without delay. Give the fuller Board report within 72 hours of awareness. The Board may allow longer on a written request.

6. 6. Let people use their rights

   LAW · ss.8(9)–(10), 11–14; Rules 9, 14 · Act pp.8–10; Rules pp.27, 29–30

   Publish ways to ask, a contact and a complaint process. Set a fair response time for complaints. It must not exceed 90 days. People can ask what data you use and who it went to. They can seek fixes, missing details, updates or erasure. They can name someone to act if they die or cannot act. Check each right’s scope.

7. 7. Erase on time

   LAW · s.8(7), (8); Rule 8(3); Seventh Schedule · Rules p.27

   Erase when consent is withdrawn or the purpose ends, unless law requires a hold. Rule 8(3) keeps personal data, traffic data and logs for at least one year from use. This hold is for Seventh Schedule purposes. Then erase unless law requires a further hold or the Government notifies one.

   OUR READING apply the one-year floor for the Seventh Schedule purposes before erasure. The statutory examples do not permit unrelated business use. The Rules do not settle every overlap. Ask your lawyer about your records.

Two add-ons: children (s.9; Rule 10) and vendors (s.8(1), (2); Rule 6(1)(f)). A person also has duties against false details, hiding material facts in official papers, impersonation and false complaints (s.15; Act p.10).

If you get it wrong

LAW · ss.27–28, Act pp.14–15: the Board can investigate and give reasoned directions after a hearing. A penalty is for a significant breach, not a fixed fee (s.33(1), Act p.16).

• Security — s.8(5): at most ₹250 crore (Schedule item 1, Act p.21).
• Breach notices — s.8(6): at most ₹200 crore (Schedule item 2, Act p.21).
• Children — s.9: at most ₹200 crore (Schedule item 3, Act p.21).
• Significant Data Fiduciary — s.10: at most ₹150 crore (Schedule item 4, Act p.21).
• Data Principal duties — s.15: at most ₹10,000 (Schedule item 5, Act p.21).
• Voluntary undertaking — s.32: at most the amount applicable to the underlying breach (Schedule item 6, Act p.21).
• Other breaches: at most ₹50 crore (Schedule item 7, Act p.21).

LAW · s.33(2), Act p.17: seriousness, duration, data type, repeat conduct, gain or loss, action to limit harm and fair size matter. Appeal within 60 days (s.29(2), Act p.15).

What is outside the law?

LAW · s.3(c), Act p.4: personal or domestic use is outside the Act. So is data made public by the person or by someone whom law requires to make it public. Section 17 lists further limited exceptions.

LAW · s.17(3), Act p.12: the Government may exempt specified businesses or classes, including startups, from some duties. Confirmation pending current notices have not been confirmed. Size alone gives no automatic exemption.

Common mistakes

• My customer is exempt, so I am too.

  No automatic inheritance. Check the named class or purpose and every condition.

  Rule 12 · Fourth Schedule

• I only help, so the law cannot reach me.

  Most tasks reach you by contract. The Board can still investigate vendors and give orders.

  s.27(2) · s.28(5)

• Every business must register in November.

  Registration is for firms that want to operate a Consent Manager.

  s.6(9) · Rule 4

• Erase everything when a job ends.

  Check the one-year floor and any longer law first. The overlap is our reading.

  Rule 8(3)

• The breach clock starts after proof.

  It starts at awareness. First notices are without delay, not after 72 hours.

  Rule 7

• A small startup is exempt.

  Confirmation pending check the actual notice. Size alone gives no relief.

  s.17(3), (5)

Check each use, not just your job title

• Your own uses: You decide why and how data is used. You are the boss for that use. s.2(i)
• Work for a customer: You handle data on their behalf. You are the helper for that use. s.2(k)
• A new use: Using customer data for your own purpose may make you its boss too. s.2(i)
• Who carries duties: The boss stays responsible for processing done on its behalf. Contracts pass tasks to helpers. s.8(1), (2)

Confirmation pending

• A working Consent Manager application process and current Board appointments.
• Later changes to commencement periods. The limited index check is not a full Gazette search.
• Current age exemptions, special-business notices, transfer restrictions and startup or class exemptions.

Plan your work

1. Map: List your data and vendors. Draft the data contract.
2. Agree: Set access controls and agree vendor tasks. Write a breach plan.
3. Test erasure: Check user requests, legal holds and record deletion.
4. Test consent: Check consent records and parent checks where needed.
5. Practise: Run a breach drill. Review the proof you keep.

Use the dates panel to set your planning target. These steps are advice, not extra legal deadlines.

Where to read the law

• MeitY — DPDP Act (Gazette PDF)
• MeitY — DPDP Rules, 2025 (Gazette PDF)
• MeitY — DPDP Rules corrigenda, G.S.R. 892(E), 10 December 2025
• MeitY — G.S.R. 843(E), commencement
• MeitY — S.O. 5458(E), wording fixes