DPDPAcademyKnow the law. Prove it.
Home/Overview & Scope
Chapter I · Sections 1–3

What the Act Governs, And Where It Stops

The Digital Personal Data Protection Act, 2023 received the President's assent on 11 August 2023. It regulates the processing of digital personal data — data about an identifiable individual, held in digital form — and balances the individual's right to protect it against lawful needs to use it.

Act No. 22 of 2023Assented 11 August 2023In force on notified dates

The four ideas that carry the law

01A lawful basis is requiredPersonal data may be processed only for a lawful purpose — with consent, or under one of the certain legitimate uses in section 7. There is no open-ended business-interest ground.
02Notice comes firstEvery consent request is accompanied or preceded by a notice: the data, the purpose, how to exercise rights, how to complain — in English or any Eighth Schedule language.
03The individual holds rightsAccess a summary of what is held and who it was shared with, correct or erase it, raise a grievance, and nominate someone to act on your behalf.
04A digital regulator enforces itThe Data Protection Board of India inquires into breaches as a digital office, may accept undertakings or direct mediation, and imposes the penalties in the Schedule.
Where it appliesInside India — to digital personal data collected in digital form, or collected on paper and digitised later.Outside India — where the processing is connected to offering goods or services to Data Principals within India.Section 3(a)–(b)
Where it does notPersonal or domestic use — data an individual processes for her own purposes.Lawfully public data — data the Data Principal made public herself, or that someone was legally obliged to publish.Section 3(c)
Illustration from the ActX, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

Exemptions worth remembering

Section 17 switches off most of Chapters II and III in defined situations. The exemptions are conditional, not a blanket carve-out.

Legal claims & courtsEnforcing a legal right, and processing by courts, tribunals or regulatory bodies performing their functions. § 17(1)(a)–(b)
Crime & investigationPrevention, detection, investigation or prosecution of any offence or contravention. § 17(1)(c)
Research & statisticsAllowed if no decision specific to a Data Principal is taken and prescribed standards are met. § 17(2)(b)
Notified State instrumentalitiesIn the interests of sovereignty, security of the State, friendly relations or public order. § 17(2)(a)
Startups, if notifiedGovernment may exempt notified classes from §§ 5, 8(3), 8(7), 10 and 11. § 17(3)
Cross-border transfersTransfers are open unless the Central Government restricts a country or territory by notification. § 16
FAQ

The DPDP Act, answered

What is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 is India's first standalone data protection law. It received the President's assent on 11 August 2023 as Act No. 22 of 2023, and runs to 9 chapters, 44 sections and one Schedule of penalties. It governs the processing of digital personal data — data about an identifiable individual, held in digital form.

Who does the DPDP Act apply to?

It applies to anyone who determines the purpose and means of processing digital personal data — the Data Fiduciary — whether that data was collected in digital form or collected on paper and digitised later. Accountability sits with the Data Fiduciary irrespective of any agreement to the contrary.

Does the DPDP Act apply outside India?

Yes, where the processing is connected to offering goods or services to Data Principals within India. A company with no Indian presence is still within scope if it offers goods or services to people in India. This is section 3(b).

What is not covered by the DPDP Act?

Two things. Personal data processed by an individual for a purely personal or domestic purpose, and personal data the Data Principal made publicly available herself or that someone was legally obliged to publish. This is section 3(c).

What are the lawful grounds for processing under the DPDP Act?

Only two: the consent of the Data Principal, or one of the nine certain legitimate uses listed in section 7. There is no open-ended legitimate-interest ground of the kind found in the GDPR.

What are the exemptions under section 17?

Section 17 switches off most of Chapters II and III for enforcing legal rights, courts and tribunals, prevention and investigation of offences, notified State instrumentalities, and research or statistical purposes where no decision specific to a Data Principal is taken. The exemptions are conditional, not a blanket carve-out.

Know this chapter? Prove it in ten questions.The practice test is free, unlimited, and shows the governing provision after every answer.
Practice TestNext: Key Roles

DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 2 August 2026 against the DPDP Act, 2023 and notified DPDP Rules, 2025. Educational information, not legal advice.

Review standards and attribution →