Home / Knowledge hub / DPDP Act 2023
Knowledge hub
DPDP Act 2023
India's law on how organisations may collect, use and protect personal data.
What it means
The Digital Personal Data Protection Act, 2023 is India’s law on how organisations handle the personal data of individuals. It calls the organisation deciding why and how data is used the Data Fiduciary, and the person the data is about the Data Principal. A company handling data for someone else is a Data Processor.
The Act is built around consent and purpose. You collect what you need, tell people why, and use it for that reason. It also puts duties on the organisation: keep the data accurate, delete it when it is no longer needed, and protect it. The last of those is where security work comes in.
Why it matters
The Act requires a Data Fiduciary to protect personal data in its possession with reasonable security safeguards, and to tell the Data Protection Board and affected people when a breach happens. The penalty schedule lists up to ₹250 crore for failing to take reasonable security safeguards. A data breach is therefore also a legal event.
It reaches further than your own systems. The Fiduciary stays responsible for data a processor handles for it, which affects contracts with vendors and agencies. Enterprise buyers are already asking for evidence of safeguards, so a clear answer helps sales as well as compliance.
How it shows up
In practice the Act lands on the places where personal data sits: sign-up forms, customer databases, support tools and analytics. Look at who can read what. An account reading another customer’s record is a broken access control problem, and it is also a safeguards problem under the Act.
The mistakes repeat. Personal data collected years ago is never deleted. Test databases hold real customer records. Logs contain identifiers nobody expected. Backups sit unencrypted. Start with a map of where personal data lives, then check that access to it is limited and that you could detect misuse.
Questions people ask
DPDP Act 2023, answered
Who does the DPDP Act apply to?
It applies to processing of digital personal data within India, and to processing outside India when it relates to offering goods or services to people in India. It covers businesses, startups and the public sector.
Exemptions exist for certain government functions and for some categories of processing.
What does reasonable security safeguards mean?
The Act does not list specific controls in its main text. It expects measures that fit the data and the risk, such as encryption, access control, monitoring and the ability to detect and recover from a breach.
The rules made under the Act can add detail.
Is the DPDP Act the same as GDPR?
They share ideas such as consent, purpose limits and breach duties, but they are different laws with different definitions, rights and penalties. Compliance with one does not automatically meet the other.
If you serve both markets, plan for both.
What is a Data Fiduciary?
The person or organisation that decides the purpose and means of processing personal data. A company collecting customer details for its own service is a Data Fiduciary for that data.
A vendor that processes data only on its instructions is a Data Processor.
Does penetration testing help with the DPDP Act?
It helps show that safeguards work. A test that finds an account reading another customer’s data, and a retest showing the fix, is concrete evidence of effort to protect personal data.
It is evidence of one control, not a compliance certificate.
Sources
Where this comes from
Related
Terms that sit next to this one
PII
Any data that points at a specific human being.
Data breach
Information you hold ends up somewhere it should not be.
Breach notification
Telling regulators and affected people about a data breach within a set time.
Data minimisation
Collecting and keeping only the personal data you actually need.
GDPR
The EU law governing personal data, with strict duties and large fines.
Can you show the safeguards work?
The Act asks for reasonable security safeguards, and evidence beats assurance. We find vulnerabilities in web apps and APIs and report only what we exploited, including cross-account access to personal data. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.