The Digital Personal Data Protection Act, 2023 governs personal data held in digital form, or digitised later, in India. A business that decides why and how personal data is used is a data fiduciary. The person the data is about is the data principal.
Core duties
- Use personal data only for a lawful purpose, with consent or for certain legitimate uses the Act lists.
- Give a clear notice of what is collected and why.
- Keep data accurate and secure, and report breaches to the Data Protection Board and to the affected people.
- Delete data when the purpose is over, unless the law requires it to be kept.
- Let people access, correct and erase their data, and withdraw consent.
- Take verifiable consent from a parent before processing a child's data.
When it applies (as of October 2026)
The DPDP Rules, 2025 were notified in November 2025 with a phased start. The Data Protection Board provisions applied at once, consent manager rules follow after one year, and most duties of data fiduciaries apply eighteen months from notification, in May 2027. Penalties under the Act go up to ₹250 crore for a failure to take reasonable security safeguards.
For an ordinary business
Customer phone numbers, staff records, patient files and visiting cards are all personal data. Knowing what you hold, where, and who can see it is the first step. This is a general summary; take legal advice for your own case.