{{ item.tag }}
{{ item.read }}
{{ item.title }}
{{ item.body }}
{{ item.basis }}
{{ item.cta }}
India's data protection law · citizen guide
Your personal data is now protected by law. Here is what that means for you.
The Digital Personal Data Protection Act, 2023 gives every person in India enforceable rights over their own personal data — and places binding obligations on every organisation that collects it. The Digital Personal Data Protection Rules, 2025 set out how those obligations work in practice. This site explains both, in plain language, with the full statutory text beside every explanation.
The law at a glance
44
sections in the Act, across 9 chapters
23
rules notified on 14 November 2025
5
rights every Data Principal holds
₹250cr
highest penalty in the Schedule
Five rights you can exercise
All rights in detail →Who is who under the Act
{{ item.tag }}
{{ item.name }}
{{ item.desc }}
Enforcement in three steps
Gazette notification G.S.R. 843(E) staggered the Act's commencement.
{{ item.date }}
{{ item.title }}
{{ item.detail }}
Browse the Act by chapter
Open the full Act →Full statutory text · Act 22 of 2023
The Digital Personal Data Protection Act, 2023
All 44 sections, arranged by chapter. Each section shows the statutory text as enacted, followed by a plain-language note on what it means in practice. Text is reproduced for awareness — verify against the official PDF before relying on it.
Jump to chapter
{{ item.roman }}
CHAPTER {{ chap.roman }}
{{ chap.name }}
{{ chap.range }}
S. {{ sec.n }}
{{ sec.title }}
{{ sec.body }}
In plain language
{{ sec.plain }}
Subordinate legislation · notified 14 November 2025
The Digital Personal Data Protection Rules, 2025
The Rules turn the Act's obligations into operational requirements — how notices must read, how consent managers are registered, what security safeguards mean, how breaches are reported, and how the Board functions as a digital office. All 23 rules are reproduced below with a practical note on each. Verify against the official PDF.
{{ item.body }}
What it requires
{{ item.plain }}
Chapter III · Sections 11 to 15
Your rights as a Data Principal
A Data Principal is the person the personal data is about — you. The Act gives you five things you can actually do, plus one duty-set you should know about. These rights apply against any organisation you gave consent to, and they are enforceable: failure to honour them can attract a penalty of up to ₹200 crore under the Schedule.
{{ item.ref }}
{{ item.title }}
{{ item.body }}
How to use it
{{ item.how }}
Limits to know
{{ item.limit }}
Your duties — Section 15
Rights come with obligations. Breaching these can cost you up to ₹10,000.
—
{{ item.text }}
Not sure which right applies?
Answer four questions and the self-assessment will tell you which right fits your situation and what to do next. It runs entirely in your browser — nothing is sent anywhere.
Open the rights self-assessment →Chapters V and VI · Sections 18 to 28
The Data Protection Board of India
The Board is the body that enforces the Act. It is not a regulator that writes rules — that power sits with the Central Government under section 40. The Board adjudicates: it inquires into breaches, directs remedial measures, and imposes monetary penalties. Sections 18 to 26, which establish it, have been in force since 14 November 2025.
{{ item.label }}
{{ item.value }}
{{ item.note }}
What the Board can do — Section 27
Section 27 sets out the Board's powers and functions. Section 28 governs how it must exercise them.
It can
✓{{ item.text }}
It cannot
✕{{ item.text }}
The Schedule — penalties
Read with section 33. The amounts below are ceilings, not fixed fines: section 33(2) requires the Board to weigh the nature and gravity of the breach, the data affected, repetition, gain or loss, mitigation, and proportionality.
| # | BREACH | MAY EXTEND TO |
|---|---|---|
| {{ item.no }} | {{ item.breach }} | {{ item.penalty }} |
Appeal route — Sections 29 to 31
A Board order is not the end of the road, and civil courts are barred from the field by section 39.
{{ item.step }}
{{ item.title }}
{{ item.detail }}
Sections 13, 27, 28 and Rules 14, 20
How to complain when your data is misused
There is a sequence, and skipping it will get your complaint returned. Section 13 requires you to use the organisation's own grievance channel first. Only if that fails — or the response period lapses — may you approach the Data Protection Board.
{{ item.n }}
{{ item.title }}
{{ item.body }}
Basis: {{ item.basis }}
Timeline: {{ item.timing }}
Have these ready
✓{{ item.text }}
Do not do this
✕{{ item.text }}
Draft your grievance letter
The complaint helper assembles a properly-framed letter citing the correct section, ready to copy into an email. It runs in your browser and stores nothing.
Chapter II · Sections 4 to 10 with Rules 3 to 13
If you handle other people's data
The Act applies to every size of organisation — a hospital, a school, a shopkeeper with a WhatsApp customer list, a listed company. There is no revenue threshold and no small-business exemption from the core duties. What changes with size is whether you are notified as a Significant Data Fiduciary and carry the extra obligations under section 10.
The date that matters
Sections 3 to 17 and 28 to 34 commence on 13 May 2027. From that day, notices, consent, security safeguards, breach reporting, rights handling and penalties are all live at once. There is no soft-landing period written into the Act.
{{ cdDays }}
DAYS LEFT
{{ item.ref }}
{{ item.title }}
{{ item.rule }}{{ item.body }}
What to actually do
{{ item.action }}
Are you a Significant Data Fiduciary?
Section 10 applies only if the Central Government notifies you as one, based on the volume and sensitivity of the data you process, risk to Data Principals, risk to electoral democracy, State security and public order. If notified, Rule 13 adds:
→{{ item.text }}
Check where you stand
Work through the readiness checklist and see your gap score, or model your exposure with the penalty calculator. Both run locally in your browser.
Gazette notification G.S.R. 843(E)
Enforcement timeline
Section 1(2) lets the Central Government bring different provisions into force on different dates. It used that power in the notification published with the DPDP Rules, 2025, creating three commencement phases. This is why the Act is described as "in force" and "not yet enforceable" at the same time — both are true, for different sections.
{{ item.date }}
{{ item.title }}
{{ item.status }}{{ item.body }}
Provisions commencing
{{ item.provisions }}
The notification, in its own words
G.S.R. 843(E). — In exercise of the powers conferred by sub-section (2) of section 1 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby appoints —
(a) the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2, sections 18 to 26, sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44 of the said Act shall come into force;
(b) one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force;
(c) eighteen months from the date of publication of this gazette, on which the provisions of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6, sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
A note on the exact date
The notification speaks in terms of "eighteen months from the date of publication" rather than naming a calendar date. Counting from publication on 14 November 2025, the eighteen-month point falls in mid-May 2027; this site uses 13 May 2027 for its countdown. Where an exact day matters legally, compute it from the gazette text and take professional advice.
Explainers
Insights and explainers
Longer notes on the questions that come up most — written for people who need to act, not for people collecting citations. Each explainer states its statutory basis so you can go and read the source yourself.
Indian privacy jurisprudence
Case laws that built the right to privacy
The DPDP Act did not create the right to privacy — the Supreme Court recognised it as a fundamental right under Article 21 in 2017, and directed the Union to build a data protection regime. These are the judgments that trace that arc, plus the cases in which Indian courts have grappled with erasure and de-indexing. No DPDP Act case law exists yet: the adjudicating provisions commence in 2027.
{{ grp.title }}
{{ grp.note }}
{{ cs.name }}
{{ cs.cite }}
{{ cs.holding }}
Free · runs in your browser · nothing transmitted
Tools
Everything below computes locally in your own browser. Nothing you type is stored, logged or sent anywhere — including to us.
Rights self-assessment
Pick what happened. The assessment maps your situation to the right that applies and tells you the next step.
The right that applies
{{ wizardResult.title }}
{{ wizardResult.body }}
Your next step
{{ wizardResult.next }}
{{ wizardResult.basis }}
The complaint process →
Complaint / request letter helper
Fill in the four fields and a properly-framed letter appears below, citing the right section. Copy it into an email to the organisation's grievance contact.
Your draft
{{ letterText }}
Penalty exposure calculator
Select the breaches in play. The calculator adds up the statutory ceilings from the Schedule. This is an upper bound for awareness only — the Board sets the actual amount after weighing the section 33(2) factors, and it is usually far below the ceiling.
Aggregate statutory ceiling
{{ penaltyTotal }}
{{ penaltyCount }}
Section 33(2) requires the Board to consider the nature, gravity and duration of the breach, the type of personal data affected, repetitive conduct, gain or loss caused, whether remedial action was taken, and proportionality — before fixing any amount.
Compliance readiness checklist
Tick what you have genuinely done. The score is a self-assessment prompt, not a certification — and it stays in this browser tab only.
{{ readyPct }}
READY
{{ readyVerdict }}
Section ↔ Rule mapping
Which rule fleshes out which section. A section with no rule against it operates on the Act's own terms.
| CHAPTER | SECTION OF THE ACT | CORRESPONDING RULE(S) |
|---|---|---|
| {{ row.chapter }} | {{ row.section }} | {{ row.rules }} |
Free to share
Awareness posters
Eleven graphics on the DPDP Act and Rules, sized for WhatsApp, Instagram and LinkedIn. Every claim carries its section or rule number. Download, print, forward, put them on a notice board — no permission needed, no attribution required. Please don't edit the statutory references.
Free to download · free to reuse for awareness
Downloads
Official texts, awareness posters you can print for an office or classroom, and starting-point policy templates. The templates are drafting aids, not legal advice — have them reviewed before you rely on them.
Terms of reuse. Share and print these freely for non-commercial awareness, but keep the disclaimer and dpbi.in footer intact, do not edit them in a way that alters their meaning, and do not present them as government material or as carrying official endorsement. Some images within them come from publicly available third-party sources, used without commercial gain for non-profit public education; all rights remain with their owners. Full legal notice & takedown policy →
Official texts
Policy and form templates
Twelve drafting starting points covering notices, consent, retention, vendors, breach and rights handling.
36 questions on the Act and the Rules
Frequently asked questions
Click a question to open it. Where an answer states a date or a figure, check it against the official text before relying on it.
{{ item.a }}
About this site
Why dpbi.in exists
India now has a data protection law that gives every person enforceable rights — and most people have never read a word of it. The law itself is short, but it is written for lawyers, and the parts that matter to an ordinary person are scattered across nine chapters and twenty-three rules.
This site puts the statutory text and a plain-language explanation side by side, so you can check the explanation against the source without leaving the page. It is free, carries no advertising, sells nothing, and collects nothing.
It is an independent citizen effort. It has no affiliation with the Government of India, the Ministry of Electronics and Information Technology, or the Data Protection Board of India, and it does not speak for them.
Contact
Public awareness website by Krishna P
info@dpbi.in
Corrections are welcome and acted on. If you spot a section reproduced wrongly or an explanation that misstates the law, please write in.
DISCLAIMER
Not authoritative. Not legal advice.
This is a public awareness website. It is not the official or authoritative website of any government body. Statutory text is reproduced for reading convenience and may contain transcription errors.
Nothing here creates a lawyer–client relationship or constitutes legal advice. For any decision with legal consequences, read the official text and consult a qualified advocate.
The authoritative sources are the Gazette of India and the Ministry of Electronics and Information Technology.
Some images are drawn from publicly available third-party sources and used without commercial gain for non-profit public education; all rights remain with their owners. Read the full legal notice, image credits and takedown policy below →
OUR OWN PRIVACY
We don't collect any data from visitors
✓No accounts, no sign-in, no newsletter.
✓No analytics, no tracking pixels, no advertising networks.
✓No cookies set by this site.
✓The tools compute in your browser; what you type is never transmitted.
✓Nothing is sold, shared or profiled — there is nothing to sell.
A site about data protection should practise it. The only personal data we ever see is what you choose to put in an email to us.
Legal notice · Terms of use · Image credits
Full disclaimer
This notice applies to every page of dpbi.in and to every image, poster, infographic, PDF and tool published or distributed by it, wherever it appears — including copies shared on social media, WhatsApp, print or email.
1. No government affiliation, sponsorship or endorsement
dpbi.in is an independent, non-commercial, citizen-run public awareness resource. It is not owned, operated, funded, authorised, endorsed or reviewed by the Government of India, the Ministry of Electronics and Information Technology (MeitY), the Data Protection Board of India, or any other statutory or regulatory authority. No association, agency, partnership or official status of any kind is claimed or should be inferred. The abbreviation "DPBI" in the domain name is used in its ordinary descriptive sense for a site about India's data protection law, and is not a claim to be, or to represent, the Data Protection Board of India. Official information is available only at the sources linked on this page.
2. Not legal advice; no professional relationship
All content is general information for public education only. It is not legal, compliance, technical, financial or professional advice, is not an opinion on any set of facts, and must not be relied upon as such. Reading this site, using its tools, or corresponding with us creates no advocate–client, consultant–client or fiduciary relationship. Before taking or refraining from any action with legal consequences, read the official text and consult a qualified advocate or competent professional.
3. Statutory text is a convenience copy — the Gazette prevails
Sections, rules, schedules, dates, penalties and citations are reproduced or summarised for reading convenience and may contain transcription, summarisation or updating errors, and may not reflect the latest amendment, notification, clarification or judicial interpretation. In the event of any difference, the text published in the Gazette of India and the notifications issued by the competent authority prevail absolutely. Reproduction of statutory material is made on the basis that, under section 52(1)(q) of the Copyright Act, 1957, there is no copyright in the reproduction of an Act of the legislature or of rules made thereunder, subject to the conditions there specified.
4. Third-party images, logos and material
Some photographs, illustrations, icons and other visual elements used on this site and in its awareness graphics are obtained from third-party and publicly available internet sources and are used in good faith, without commercial gain, solely for non-profit public education and awareness — as fair dealing for the purposes of private study, research, criticism, review and the reporting of current affairs under section 52 of the Copyright Act, 1957. No ownership is claimed over such material; all copyright, trademarks, logos, emblems, names and other rights remain with their respective owners, and their use here does not imply any endorsement by, or association with, those owners. Where a source is known it is credited; where it is not, credit was not reasonably ascertainable. If you are a rights holder and believe material of yours has been used without proper credit or permission, write to info@dpbi.in with the URL or file name and proof of ownership — we will add attribution or remove the material promptly, ordinarily within 72 hours, without contest. No claim of hardship or damages arises from such good-faith use, and removal on request is our complete undertaking.
5. National emblem, names and insignia
This site does not use the State Emblem of India, the Government of India identity, or any name or emblem restricted by the Emblems and Names (Prevention of Improper Use) Act, 1950, in any manner suggesting official patronage. The tricolour band used in our graphics is a decorative civic motif, not the National Flag or any official insignia, and is used respectfully in the spirit of the Flag Code of India. References to "Viksit Bharat 2047" express civic aspiration only and imply no government sponsorship.
6. No warranty; limitation of liability
All content, tools and downloads are provided "as is" and "as available", without any warranty of accuracy, completeness, currency, merchantability or fitness for a particular purpose. The self-assessment tools, checklists, templates, notice generators and countdown are illustrative aids only, produce no legally valid document or determination of compliance, and their output must be reviewed by a competent professional before any use. To the fullest extent permitted by law, the operator of this site shall not be liable for any loss, damage, penalty, claim or expense — direct, indirect, incidental, consequential or punitive — arising from the use of, or reliance on, anything published here, or from any error, omission or unavailability.
7. External links
Links to government and third-party websites are provided for convenience. We do not control, and are not responsible for, the content, accuracy, availability or privacy practices of any external site, and a link is not an endorsement.
8. Privacy
We collect no personal data from visitors: no accounts, forms that transmit, analytics, tracking pixels, advertising networks or cookies set by this site. The tools run entirely in your browser and what you type is never transmitted to us. The only personal data we ever hold is what you voluntarily include in an email to us, used solely to reply and not shared or sold. Your hosting provider or network may keep its own technical logs, which are outside our control.
9. Reuse of our own material
Our original text and awareness graphics may be freely downloaded, printed and shared for non-commercial awareness, provided they are not edited to alter their meaning, the disclaimer and dpbi.in footer are kept intact, and they are not presented as government material or used to suggest official endorsement. Third-party elements within them remain subject to clause 4.
10. Corrections, grievances and governing law
Corrections and complaints about any content, including any takedown request, may be sent to info@dpbi.in and will be acted on in good faith. This notice is governed by the laws of India, and the courts at the operator's place of residence in India shall have exclusive jurisdiction. If any clause is held unenforceable, the remainder continues in effect. We may update this notice at any time; the version published here governs.
By using this website, its tools or its downloadable graphics, you acknowledge that you have read and accepted this notice. Last updated 13 September 2026.
Search
{{ searchHeading }}
Searches the full text of all 44 sections, all 23 rules, and every FAQ — in your browser.