In today’s digital world, almost every online activity involves sharing personal information. Whether you are shopping online, booking a cab, using a banking app, or signing up for social media, companies collect data such as your name, phone number, email address, location and payment details. With the rapid growth of digital services, concerns over how this personal information is collected, stored and used have also increased.
To address these concerns, the Government of India introduced the Digital Personal Data Protection (DPDP) Act, 2023. The law aims to protect the personal data of individuals while allowing organisations to process such data for lawful purposes. It lays down clear rules for companies, government bodies and digital platforms on how they should handle personal information and gives citizens greater control over their data.
Simply put, the DPDP Act is India’s data privacy law. It ensures that organisations cannot collect or use your personal information without following specific rules. The Act also establishes a framework for consent, grievance redressal and penalties for companies that fail to protect personal data. Here is a simple breakdown of what the law means.
What is the DPDP Act?
The Digital Personal Data Protection (DPDP) Act, 2023 is India’s law that regulates how digital personal data is collected, processed, stored and protected.
What is personal data?
Personal data means any information that can identify an individual, such as name, mobile number, Aadhaar, email address, photographs, financial details or location data.
Who does the law apply to?
The Act applies to organisations processing digital personal data in India. It also covers companies outside India if they offer goods or services to people in India.
Why was the Act introduced?
Its main objective is to protect individuals’ privacy while allowing businesses and governments to use personal data for legitimate and lawful purposes.
What is consent?
Organisations must obtain clear, informed and voluntary consent before collecting or processing personal data in most cases. Users can also withdraw consent whenever they choose.
What rights do individuals get?
The Act gives people the right to:
- Know how their data is being used
- Correct inaccurate information
- Request deletion of personal data
- File complaints if their rights are violated
- Nominate another person to exercise these rights in case of death or incapacity
What are companies required to do?
Businesses must:
- Protect personal data with appropriate security measures
- Inform users about data collection
- Report data breaches
- Delete data when it is no longer needed, unless required by law to retain it
- Provide an effective grievance redressal mechanism
How does the Act protect children?
Companies must obtain verifiable parental consent before processing the personal data of children under 18 years. They are also prohibited from targeted advertising and behavioural tracking of children.
Who enforces the law?
The Act establishes the Data Protection Board of India, which will investigate complaints, examine data breaches and impose penalties for violations.
What are the penalties?
The Act provides for significant financial penalties. Serious violations, such as failing to protect personal data, can attract penalties of up to Rs 250 crore, depending on the nature of the breach.
Why does the DPDP Act matter?
The law strengthens digital trust by giving individuals greater control over their personal information while ensuring organisations adopt responsible data handling practices. It is expected to improve privacy standards across India’s rapidly expanding digital economy.
