Think about the last time you downloaded a new app. Within seconds, it asked for your phone number, then your location, then access to your contacts. You probably tapped “Allow” without a second thought. Most of us do.

We build apps for a living, so we see this from both sides. As users, we want to know where our information goes. As a company, we need to know what we are allowed to collect and what we must do to protect it. For years in India, there was no clear answer to either question.

That changed with the Digital Personal Data Protection (DPDP) Act. In this article, we want to explain it the way we wish someone had explained it to us: simply, without legal jargon, and with a focus on what it actually means for you.

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s first complete law on how personal data must be collected, used, stored and deleted. Parliament passed it in August 2023. In simple words, it is a rulebook that tells every company, app and organisation how they must treat your personal information.

“Personal data” means any information that can identify you. Your name, phone number, email address, Aadhaar number, photo, location and even your shopping history all count. If a company holds this information in digital form, the law applies to it.

The idea of the DPDP act is simple. Your data belongs to you. A company can use it only for a clear purpose, usually only with your permission, and only for as long as it truly needs it.

Why did India need this law?

India has one of the largest populations online in the world. Almost everything we do, from paying for tea to booking a doctor’s appointment, now leaves a trail of data behind it. Until recently, the rules protecting that data were thin and scattered across older laws.

The turning point came in 2017. In the Justice K.S. Puttaswamy case, the Supreme Court of India declared that privacy is a fundamental right of every citizen. Once privacy became a fundamental right, India needed a proper law to protect it in the digital world. After several drafts and years of debate, that law became the DPDP Act.

If you have ever received a spam call and wondered how a stranger got your number, you already understand the problem this law is trying to solve.

The four words you need to know

The DPDP act uses a few formal terms. They sound heavy, but each one has a very simple meaning.

  • Data Principal. This is you, the person the data is about. When the law talks about the rights of a data principal, it is talking about your rights.
  • Data Fiduciary. This is the company or organisation that decides why and how your data is used. Your bank, your food delivery app and your school are all data fiduciaries. The word “fiduciary” means someone who holds something in trust. That is exactly the point: a company holding your data is trusted with it, not given ownership of it.
  • Consent Manager. This is a registered platform that will help you give, track and take back your consent across many companies from one place. Think of it as a single dashboard for all the permissions you have handed out.
  • Data Protection Board of India (DPB). This is the body that enforces the law. It looks into complaints, investigates data breaches and can impose penalties on companies that break the rules.

What rights does the DPDP act give you?

This is the part we found most exciting, because it gives ordinary people real power for the first time.

  • First, a company must ask for your consent in clear and plain language before it uses your data. The request should say what data it wants and why. You can also ask to see the notice in English or in any of the 22 languages listed in the Eighth Schedule of our Constitution. Consent cannot be hidden inside a long page of terms and conditions.
  • Second, you can change your mind. You can withdraw your consent at any time, and the law says withdrawing it should be as easy as giving it.
  • Third, you can ask a company what personal data it holds about you, how it is using that data and who it has shared it with.
  • Fourth, you can ask the company to correct wrong information, complete missing details, update old records or delete data it no longer needs.
  • Fifth, every company must give you a way to raise a complaint. If the company does not resolve your complaint, you can take it to the Data Protection Board.
  • Finally, you can nominate someone you trust to exercise these rights on your behalf if you pass away or are unable to act yourself.

The law also expects something from you. You must not file false or frivolous complaints, and you must not give false information about yourself. Rights come with responsibility.

Who does the DPDP act apply to?

The short answer is almost everyone who handles personal data in India. It does not matter whether you are a large bank, a hospital, a coaching centre or a two-person startup like many of the ones I know. If you collect personal data digitally, or collect it on paper and later digitise it, the law applies to you.

It also reaches beyond India’s borders. A company based abroad must follow the DPDP act if it offers goods or services to people in India.

There are a few exceptions. Data you use for purely personal or household reasons, like the contacts saved on your own phone, is not covered. Neither is information that a person has chosen to make public themselves.

What businesses must do to align with the DPDP Act?

If you run a business, here is what the law expects from you in everyday terms:

  • Collect only the data you genuinely need for a clear purpose, and tell people what that purpose is.
  • Take valid consent, and make it just as easy for people to withdraw it.
  • Keep the data accurate and protect it with reasonable security safeguards.
  • Delete the data once the purpose is over, unless another law requires you to keep it.
  • Tell the Data Protection Board and every affected person if a data breach happens.
  • Publish contact details of someone who can answer questions about how you handle data.
  • Hold every vendor who processes data for you, such as a cloud or analytics provider, to the same standard.

The government can also label some companies as Significant Data Fiduciaries (SDFs), based on how much data they handle and how sensitive it is. These are usually large platforms, banks and similar players. They carry extra duties, such as appointing a Data Protection Officer based in India, running regular data protection impact assessments and getting independent audits.

What about children’s data?

This is where the law is strictest, and we believe rightly so. Under the DPDP Act, anyone below 18 years of age is treated as a child.

Before a company processes a child’s personal data, it must get verifiable consent from a parent or lawful guardian. A simple “I am above 18” checkbox is not enough. The company must take reasonable steps to confirm that the person giving consent really is a parent or guardian. The same care applies to people with disabilities who have a lawful guardian.

The DPDP act also bans companies from tracking children, monitoring their behaviour or showing them targeted advertisements. If you are building anything for students, like an education app, this section deserves your full attention from day one.

What happens if a company breaks the rules?

The penalties are serious enough to get the attention of any boardroom. The Data Protection Board can impose fines for each instance of a violation. The maximum amounts are:

Violation Maximum penalty
Failing to take reasonable security safeguards to prevent a data breach ₹250 crore
Failing to inform the Board and affected people about a data breach ₹200 crore
Failing to meet the extra duties for children’s data ₹200 crore
Failing to meet the extra duties of a Significant Data Fiduciary ₹150 crore
Any other breach of the act or the Rules ₹50 crore
A data principal breaking their own duties, such as filing a false complaint ₹10,000

These are upper limits, not fixed amounts. While deciding a penalty, the Board looks at how serious the breach was, how long it lasted, how many people it affected and what the company did to fix it.

When will the DPDP act come into force?

A law tells you what must be done. Rules tell you how to do it. The DPDP act was passed in 2023, but it needed detailed rules before it could work in practice. The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 in November 2025, and that started the clock. The government chose to roll the law out in three phases, so that businesses have time to prepare:

  1. November 2025: The Data Protection Board of India was set up, and the basic and procedural parts of the law came into force.
  2. November 2026: The provisions for registering Consent Managers come into effect.
  3. May 2027: Most of the remaining duties come into force, including consent notices, security safeguards, breach reporting and the rules for children’s data.

One thing to watch: in early 2026, MeitY discussed bringing some of these deadlines forward, especially for large companies. Always check the official notifications for the latest dates. My honest advice is not to wait for the final deadline. If you are building something today, build it the right way from the start.

Common myths about the DPDP Act

“It only applies to big tech companies.” It does not. Size does not matter. A small clinic, a local school or a solo founder with a hundred users is covered if they handle personal data digitally. Big companies simply carry some extra duties on top.

“Adding a privacy policy is enough.” A long policy page that nobody reads does not count as real consent. The law asks for a clear, separate and easy-to-understand notice for each purpose.

“Once I agree, the company can use my data forever.” No. Your consent covers a specific purpose. When that purpose is over, or when you withdraw consent, the company must stop using the data and, in most cases, delete it.

“This is the same as Europe’s law.” The DPDP act shares ideas with the General Data Protection Regulation (GDPR) of the European Union, but it is a different and simpler law, written for India. I will compare the two in a separate post in this series.

Our take as a technology company

When we first read the DPDP Act, our reaction was the same as most people: this sounds like more paperwork. The more we understood it, the more we saw it differently.

At its core, the law asks for three things: be honest about what you collect, collect only what you need and take good care of it. Those are not legal burdens. They are simply good product decisions. An app that asks for less data is easier to trust, easier to secure and easier to maintain. Users notice that respect, even if they never read the law.

So who should care about this Act? If you use the internet, you should know your rights, because they are now real and enforceable. If you run a business of any size, you should start preparing now rather than in a hurry before the deadline. And if you build products like I do, you have a chance to treat privacy as a feature rather than a chore.

Official sources and further reading

This post explains the law in simple terms for general understanding. It is not legal advice. For decisions about your business, please consult a qualified legal professional.