The Digital Personal Data Protection Act, 2023
An easy-to-understand guide to India's data protection law. Explore all 9 chapters, 44 sections, and the penalty schedule below.
What is the DPDP Act 2023?
📖 Glossary →The Digital Personal Data Protection Act, 2023 is India's first comprehensive legislation dedicated to protecting the personal data of individuals. It regulates how organizations (called Data Fiduciaries) collect, process, store, and share the personal data of individuals (called Data Principals).
The Act balances two fundamental interests: the right of individuals to protect their personal data and the need to process such data for lawful purposes.
Non-compliance can result in penalties of up to ₹250 Crore for failure to maintain reasonable security safeguards, making compliance essential for every business operating in India.
Jump to a Chapter
Jump to a Section
All Chapters of the DPDP Act
Chapter I: Preliminary
Sections 1–3
Introductory provisions including short title, definitions, and application of the Act.
Chapter II: Obligations of Data Fiduciary
Sections 4–10
Rules governing how entities that collect and process personal data must operate.
Chapter III: Rights and Duties of Data Principal
Sections 11–15
Empowering individuals with rights over their personal data and corresponding responsibilities.
Chapter IV: Special Provisions
Sections 16–17
Exceptions and specific scenarios where standard rules may not apply.
Chapter V: Data Protection Board of India
Sections 18–26
Establishment, composition, and administration of the regulatory body.
Chapter VI: Powers, Functions and Procedure to be Followed by Board
Sections 27–28
Operational powers of the Board and the process for handling complaints and inquiries.
Chapter VII: Appeal and Alternate Dispute Resolution
Sections 29–32
Mechanisms for challenging Board decisions and resolving disputes.
Chapter VIII: Penalties and Adjudication
Sections 33–34
Monetary penalties for violations and factors considered during adjudication.
Chapter IX: Miscellaneous
Sections 35–44
General provisions including rule-making powers, consistency with other laws, and transitional arrangements.
THE SCHEDULE
Monetary penalties for breach of provisions of the Digital Personal Data Protection Act, 2023
| Sl. No. | Breach | Penalty |
|---|---|---|
| 1 | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8 | ₹250 Crore |
| 2 | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8 | ₹200 Crore |
| 3 | Breach in observance of additional obligations in relation to children under section 9 | ₹200 Crore |
| 4 | Breach in observance of additional obligations of Significant Data Fiduciary under section 10 | ₹150 Crore |
| 5 | Breach in observance of the duties under section 15 | ₹10,000 |
| 6 | Breach of any term of voluntary undertaking accepted by the Board under section 32 | As per original breach |
| 7 | Breach of any other provision of this Act or the rules made thereunder | ₹50 Crore |
Need help becoming DPDP compliant?
We help D2C businesses in India comply with the DPDP Act 2023. From consent management to grievance redressal, we handle it all.
Book a Free Compliance Consultation