Skip to content
Milvao
Glossary

DPDP Act (Digital Personal Data Protection Act, 2023)

India's Digital Personal Data Protection Act, 2023: who counts as a data fiduciary or data principal, and the rules on notice, consent, safeguards and breaches.

Updated 2 min read
Summarise
How it works

Definition: The DPDP Act is India's Digital Personal Data Protection Act, 2023, the law on how organisations process digital personal data. It received the President's assent on 11 August 2023. It calls those who decide how data is used data fiduciaries and the people it is about data principals, and requires notice, valid consent or a legitimate use, security safeguards and breach reporting. This is general information, not legal advice.

Key takeaways

  • It applies to personal data in digital form, including data collected offline and later digitised.
  • Consent must be free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give.
  • The DPDP Rules, 2025 phase in compliance over eighteen months.

Key terms in the DPDP Act

  • Data fiduciary: anyone who, alone or with others, decides the purpose and means of processing personal data (section 2(i)).
  • Data principal: the person the data is about, including a parent or guardian for a child (section 2(j)).
  • Data processor: anyone who processes data on a fiduciary's behalf (section 2(k)).
  • Consent manager: a registered body that lets people give, manage, review and withdraw consent (section 2(g)).
  • Data Protection Board of India: the body that enforces the Act.

What the DPDP Act asks of organisations

  • Give a notice saying what data is processed and why, and how to exercise rights (section 5).
  • Get consent that is free, specific, informed, unconditional and unambiguous, limited to the data needed (section 6).
  • Use processors only under a valid contract, and stay responsible for what they do (section 8).
  • Take reasonable security safeguards, tell the Board and each affected person about a breach, and erase data once consent is withdrawn or the purpose is served (section 8).

Penalties are set in the Schedule. Failing to take reasonable security safeguards can draw a penalty of up to ₹250 crore.

When the DPDP Act applies

The government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. According to the government's press backgrounder, the Rules give organisations an eighteen-month period for phased compliance, and set up a fully digital Data Protection Board with four members. Check the current status of each provision with an adviser.

The DPDP Act for community organisers

A community that collects members' names, numbers and profiles decides why and how that data is used, which usually makes it the data fiduciary. With Milvao, the community is the data fiduciary for members' data and Milvao acts as its data processor under a data processing agreement. How Milvao's features map to the Act is on the DPDP compliance page.

Sources

Facts about WhatsApp and other services come from the pages listed, on the dates shown, and can change.

FAQ

Questions about dpdp act

The Act has no general exemption by size. The government can notify some fiduciaries, including startups, as exempt from certain provisions. If your community processes members' digital personal data, assume it applies and take advice.

No. The Act does not create a certificate. Organisations show compliance through what they do: notices, consent records, security and handling requests.

They share ideas, such as consent and purpose limits, but differ in detail. The DPDP Act uses its own terms, like data fiduciary instead of controller.
30-day pilot

Make your first introductions this month

We connect your business number, set up join links for two or three of your groups and help your first members get introduced.

Talk to us