Rights
Digital Personal Data Protection Act 2023, phased into force
The DPDP Act replaces the earlier IT Rules framework with a consent-centred regime supervised by a Data Protection Board. Rules bringing provisions into force are being notified in stages.
Key rules
- Consent notices must be available in English and the languages of the Eighth Schedule.
- Significant data fiduciaries face additional audit and DPO obligations.
- Transfers are permitted except to countries the government restricts by notification.
Governing law
- Digital Personal Data Protection Act 2023
- Information Technology Act 2000
Penalties and consequences
- Up to ₹250 crore per breach of security safeguards
In practice
Because commencement is phased, the operative question for any given obligation is whether its rule has actually been notified yet.