The DPDP Act 2023 Explained: Your Digital Privacy Rights in India

India's Digital Personal Data Protection Act, 2023 is the country's main personal data law for digital personal data. But the most important practical point for users is this: the Act exists, yet the legal system is still rolling its core rights and obligations into force in phases.

What is the DPDP Act meant to do?

At a high level, the Act creates the legal framework for how digital personal data should be collected, used, protected, corrected, and erased in India. It covers digital personal data, including data collected online and some offline data that is later digitized.

The Act uses its own terminology. A person whose data is being used is called a Data Principal. The organization deciding why and how that data is processed is a Data Fiduciary. In everyday language, that usually means you and the company, app, platform, employer, service provider, or institution handling your digital personal data.

What rights does the Act create?

Once the relevant substantive sections are in force, the Act creates a set of rights and processes for Data Principals. In simplified terms, the best-known ones include:

What does the law expect from organizations?

Again, once the relevant provisions commence, the Act expects Data Fiduciaries to do more than simply publish a vague privacy policy. In practical terms, the framework expects them to:

• process data only on legally recognized grounds under the Act;
• give notice in a clear format;
• protect personal data with reasonable security safeguards;
• delete data when purpose is complete unless retention is legally required; and
• follow additional duties where children or certain notified classes are involved.

What changed on November 13, 2025?

The official Gazette notification dated November 13, 2025 did not switch on the entire Act at once. It created three commencement buckets:

• Immediate commencement on publication: section 2, sections 18 to 26, section 35, sections 38 to 43, and parts of section 44, along with section 1(2).
• One-year commencement: section 6(9) and section 27(1)(d).
• Eighteen-month commencement: sections 3 to 5, most of section 6, sections 7 to 17, most of section 27, sections 28 to 34, sections 36 and 37, and part of section 44.

That eighteen-month bucket is especially important because it includes many of the sections people normally associate with notice, consent, and Data Principal rights. So if someone tells you "all your DPDP rights are already fully live today," that is too simplistic.

What should users do right now?

Even during a phased rollout, you should still treat privacy notices and grievance channels seriously. Good practical steps include:

• read the app or platform privacy notice before sharing sensitive information;
• use official in-app or company grievance channels and keep screenshots or email records;
• avoid sharing excessive KYC, financial, medical, or family documents where unnecessary;
• watch for updated privacy notices as providers adjust to the Act and future rules; and
• track official notifications instead of relying on social media summaries.

What about children's data?

The Act gives special attention to the processing of children's personal data and creates higher obligations in that area. The detailed operational picture also depends on the relevant sections and rules coming into force. If a service is aimed at or widely used by children, its compliance burden is likely to be much higher than an ordinary "accept all cookies" approach.

Official sources