Digital Personal Data Protection Act, 2023 Alongwith Rules, 2025

This 2025 edition of The Digital Personal Data Protection Act, 2023 (Act 22 of 2023, dt. 11-8-2023) reproduces India’s first horizontal privacy statute verbatim and encloses the draft Digital Personal Data Protection Rules, 2025 (G.S.R. 02 E, dt. 03-1-2025) released for stakeholder consultation.

Concise, practice-oriented short comments accompany pivotal clauses—flagging notice-and-consent elements, children’s processing safeguards, cross-border transfer whitelisting, and the Data Protection Board’s graded-penalty table—while preserving full Bare-Act integrity for examinations and authoritative citation.

Core statutory coverage

• Definitions & scope — “personal data,” “consent manager,” “significant data fiduciary,” “data principal,” and territorial reach for foreign platforms.

• Consent & notice — plain-language, itemised purposes; consent manager ecosystem; one-click withdrawal.

• Processing of children’s & sensitive data — parental verifiable consent, “harm” test, and targeted-advertising ban.

• Data principal rights — access, correction, erasure, grievance redress, and “nominate” right for incapacitated users.

• Obligations of data fiduciaries — purpose limitation, privacy-by-design, Data Protection Impact Assessment (SDPs), and breach-notification within 72 hours.

• Cross-border transfers — “blacklist” principle; default free flow except to specifically restricted jurisdictions.

• Data Protection Board of India — inquiry powers, ₹250-crore maximum penalty per contravention, voluntary-undertaking regime.

• Compounding & appeal — compounding window before Board, appellate jurisdiction of TDSAT, writ to High Court/Supreme Court.

This edition is particularly suited for

• In-house counsel, DPOs & compliance leads preparing privacy policies, DPIsAs and vendor-contract addenda.

• Start-ups, SaaS providers & cross-border platforms mapping data flows, age-gate mechanisms and transfer-risk assessments.

• Policy researchers, journalists & civil-society bodies tracking implementation of India’s post-Puttaswamy privacy framework.

• Cyber-law advocates & tech-litigators handling breach-penalty proceedings before the Data Protection Board.

• AIBE candidates and law students studying information-technology, constitutional-privacy and comparative-GDPR modules.

Exact Gazette text · pinpoint explanatory notes · zero superfluous commentary—your fastest route to clarity, authenticity and practical insight on India’s new data-protection regime.