Explainer · Data Protection · Last verified October 2026

The DPDP Act 2023 for Businesses, Explained (2026)

Updated for 2026 · Claw Editorial

For years India had no dedicated law on personal data. That has changed. The Digital Personal Data Protection Act, 2023 now governs how any business handles the personal data of people in India, and the rules that make it operational were notified in November 2025. For a business, this is no longer a theoretical compliance topic; it is a live obligation with teeth, including penalties that run to hundreds of crores. This explainer, for founders, operators and in-house teams, sets out what the Act asks of a business, the rights it gives your customers, and what you should be doing now. It is general information, not legal advice. Last verified October 2026.

The short answer

New law: the Digital Personal Data Protection Act, 2023 governs how any business processes personal data of people in India.
Roles: your business is a Data Fiduciary; the individual is a Data Principal with rights of access, correction, erasure and grievance.
Core duties: clear notice and consent, use for the stated purpose only, reasonable security, breach reporting and a grievance contact.
Penalties: up to Rs 250 crore for a failure of security safeguards, enforced by the Data Protection Board.
Rules status: the DPDP Rules, 2025 were notified in November 2025 and come into force in phases, with main obligations into 2027.

01The short answer

If your business collects personal data of people in India, the DPDP Act, 2023 asks you to:

Take clear consent and give a plain-language notice saying what data you collect and why.
Use data only for the stated purpose, keep it secure, and delete it when it is no longer needed.
Honour the rights of the people whose data you hold: access, correction, erasure and grievance redressal.
Report a data breach and appoint a contact for grievances, with a Data Protection Officer required for the largest players.

Get it wrong and the penalties are large, up to Rs 250 crore for failing to keep data secure. The rules that operationalise all this were notified in November 2025 and are coming into force in phases.

02What the DPDP Act is

The Digital Personal Data Protection Act, 2023 is India's first standalone law on personal data. It governs the processing of digital personal data, that is personal data in digital form or digitised later, about an identifiable individual. It replaces the thin protection that existed earlier under the Information Technology Act and its 2011 rules.

Its structure is simple to grasp. A business that decides how and why personal data is used is a Data Fiduciary. The individual whose data it is, is a Data Principal. The Act sets duties on the fiduciary and gives rights to the principal, and a Data Protection Board enforces both.

03Who it applies to

The Act applies to the processing of digital personal data within India, and also to processing outside India where it is in connection with offering goods or services to people in India. So a business based abroad that serves Indian customers is covered.

It applies whether the data is collected online or collected offline and then digitised. There are carve outs, for purely personal or domestic use and for certain publicly available data, and the State has its own exemptions. The practical message for most businesses is simple: if you hold customer, user or employee personal data in digital form, you are a Data Fiduciary and the Act applies to you.

04Core obligations for businesses

The duties of a Data Fiduciary run through the Act. The main ones are:

Notice and consent. Give a clear notice of what you collect and why, and take free, specific, informed and unambiguous consent for it. Consent must be as easy to withdraw as to give.
Purpose and minimisation. Use data only for the purpose it was given for, and keep only what you need.
Security safeguards. Protect the data with reasonable security measures. A failure here carries the heaviest penalty.
Breach reporting. Notify the Board and affected individuals of a personal data breach.
Children's data. Take verifiable parental consent for a child's data and do not track or target children.
Grievance redressal. Publish the contact of a person who answers data grievances; a Significant Data Fiduciary, a large or high-risk player the government notifies, must appoint a Data Protection Officer based in India and run independent audits.

05The rights your customers now have

The Act gives each Data Principal a set of rights your business must be ready to honour:

Right	What it means for you
Access (Section 11)	Tell the person what data of theirs you hold and how you have used it
Correction and erasure (Section 12)	Correct, complete or delete their data on request
Grievance redressal (Section 13)	Provide a working channel to raise and resolve complaints
Nomination (Section 14)	Let a person nominate someone to exercise rights if they die or are incapacitated

Build these into your product and support process, not as a one-off. A request for access, correction or erasure can come from any customer, and you must answer it within the time the rules set.

06The Board, penalties and appeals

Enforcement sits with the Data Protection Board of India, a body that inquires into breaches and can impose monetary penalties. The amounts are set in the Schedule to the Act, referred to in Section 33:

Up to Rs 250 crore for failing to maintain reasonable security safeguards.
Up to Rs 200 crore for failing to report a breach or breaching children's data obligations.
Up to Rs 150 crore for a Significant Data Fiduciary's breach of its extra duties.
Up to Rs 50 crore for any other breach, and up to Rs 10,000 on a Data Principal who breaches their duties.

A party aggrieved by a Board order can appeal to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), within 60 days under Section 29.

07Where the rules stand in 2026

The Act needed rules to work, and they arrived. The Digital Personal Data Protection Rules, 2025 were notified in November 2025. They do not all switch on at once; they are coming into force in phases.

The governance provisions, including those that stand up the Data Protection Board, took effect on notification. Some parts, such as registration of consent managers, follow after about a year, and the bulk of the day-to-day compliance obligations apply after a longer transition, which places the main compliance date into 2027.

The DPDP Rules, 2025 are being brought into force in phases and the exact dates for each obligation are set by the notification. Confirm the current status and your specific deadline before relying on a date.

undefined

08What to do now

Even with a phased rollout, the sensible steps for a business are clear and worth starting before the deadlines bite:

Map your data. Know what personal data you collect, where it sits, why you have it and who you share it with.
Fix consent and notice. Rewrite sign-up flows and privacy notices in plain language, with real consent and easy withdrawal.
Set up rights handling. Build a process to answer access, correction and erasure requests within time.
Harden security and plan for breaches. Put reasonable safeguards in place and a tested breach-response plan.
Name a grievance contact, and check whether you are likely to be a Significant Data Fiduciary needing a Data Protection Officer.

Treating this as a one-time legal task misses the point; it is an operating change across product, engineering and support.

09Where Claw fits

Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.

Building your consent flows and compliance process is work for your team and advisers; Claw does not do that for you. Where Claw helps is research and in tracking enforcement once it starts. Claw tracks matters before the Data Protection Board and appeals to the Appellate Tribunal (TDSAT), along with related proceedings in the High Courts and the Supreme Court, across 9,102 courts, benches and forums, with alerts and monitoring, so a business or an adviser sees how the new law is being applied. Its Legal GPT researches across 30 crore+ judgments, with Supreme Court decisions from 1950 and High Court decisions from 1990, so you can see how courts have treated related data and privacy questions. Results return in under 5 seconds, and Claw does not train its AI models on your documents. To check whether a vendor or partner already has litigation on record before you share data with them, run a case search across Indian courts by company name. A clean result means nothing was found on the forums and date searched, not that nothing exists, and this is general information, not legal advice.

10Sources and further reading

Ministry of Electronics and IT (DPDP Act and Rules): meity.gov.in
India Code (Digital Personal Data Protection Act, 2023): indiacode.nic.in
Claw: clawlaw.in

This explainer is general information, not legal advice. The Act is being operationalised in phases by rules that can change; confirm the current position and your deadlines before you act.

11Frequently asked questions

Does the DPDP Act apply to my business?

If you process digital personal data of people in India, yes. The Act applies to processing within India and to processing outside India where it relates to offering goods or services to people in India, so even a foreign business serving Indian customers is covered. It applies whether the data is collected online or collected offline and then digitised. Most businesses that hold customer, user or employee data are Data Fiduciaries under the Act.

What are the main obligations for a business under the DPDP Act?

Give a clear notice and take free, specific, informed and unambiguous consent; use data only for the stated purpose and keep only what you need; protect it with reasonable security safeguards; report a personal data breach to the Board and affected individuals; take verifiable parental consent for children's data; and provide a grievance contact. A Significant Data Fiduciary must also appoint a Data Protection Officer in India and run independent audits.

What are the penalties under the DPDP Act?

Penalties are set in the Schedule to the Act and imposed by the Data Protection Board. They run up to Rs 250 crore for failing to maintain reasonable security safeguards, up to Rs 200 crore for failing to report a breach or breaching children's data duties, up to Rs 150 crore for a Significant Data Fiduciary's extra duties, up to Rs 50 crore for other breaches, and up to Rs 10,000 on a Data Principal who breaches their duties.

Are the DPDP Rules in force yet?

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and are being brought into force in phases. The governance provisions, including those standing up the Data Protection Board, took effect on notification. Registration of consent managers follows after about a year, and the bulk of the day-to-day compliance obligations apply after a longer transition, which places the main compliance date into 2027. Confirm your specific deadline, as dates are set by the notification.

What rights do my customers have over their data?

A Data Principal has the right to access information about the data you hold and how you used it (Section 11), to have it corrected, completed or erased (Section 12), to a grievance redressal channel (Section 13), and to nominate another person to exercise their rights if they die or are incapacitated (Section 14). Your business must be able to answer these requests within the time the rules set.