LEXACORE
DPDP Act 2023 Guide
India's Digital Personal Data Protection Act, 2023 — explained for businesses. Obligations, consent, and compliance.
What is the DPDP Act?
Overview
The Digital Personal Data Protection Act 2023 governs processing of digital personal data in India, balancing citizen privacy with lawful data use.
Key Rights
Data principals have rights to access, correction, erasure, grievance redressal and consent withdrawal.
Obligations
Data fiduciaries must implement reasonable security safeguards, consent notices, and breach notification within 72 hours.
Compliance Checklist
Consent Management
Obtain free, specific, informed, unconditional consent with clear notice in the languages understood by the user.
Security Safeguards
Implement reasonable safeguards — encryption at rest and in transit, access controls, audit logs.
Breach Notification
Notify the Data Protection Board and affected data principals within 72 hours of a breach.
Children's Data
Verifiable parental consent required for processing data of children under 18.
Penalties
Non-compliance
Penalties up to ₹250 crore for significant breaches of obligations.
Board Powers
The Data Protection Board of India can direct remedial action, compensation and penalties.