PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Implementation remains partial and rule-dependent, so field-level caution is needed until operational rules and regulator practice mature.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statuspartial1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to digital personal data processing in India and to overseas processing tied to offering goods or services to individuals in India.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryData Protection Board of India1 primary • Reviewed 17/04/2026

Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: partialSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Effective date: 2023-08-11Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Last amended: 2023-08-11Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to digital personal data processing in India and to overseas processing tied to offering goods or services to individuals in India.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies broadly to data fiduciaries processing digital personal data.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Public sector coverage: Public bodies may also be covered, subject to statutory exemptions and government notifications.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal data means any data about an individual who is identifiable by or in relation to such data.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Sensitive data recognized: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: consent, legitimate useSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Requires legal basis: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to object: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to portability: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: Emerging erasure / deletion structureSupport: 1 primary • Reviewed 17/04/2026Sources: DPDPA text (primary)Note: India's framework is still emerging and operational details remain rule-dependent.
Right to rectification or correction summary: Correction / completion rightsSupport: 1 primary • Reviewed 17/04/2026Sources: DPDPA text (primary)Note: India's correction-related rights should be read with implementation caution.

Breach

Breach deadline (hours): 0Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Governance

DPO required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Impact assessment required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Records of processing required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: The Act contemplates significant administrative monetary penalties for specified violations.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private right of action: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Data Protection Board of IndiaSupport: 1 primary • Reviewed 17/04/2026Sources: DPDPA text (primary)Note: India's institutional enforcement framework remains tied to an emerging implementation environment.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Consent-driven digital tracking analysis will likely evolve alongside DPDPA implementation rules.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: DPDPA text (primary); MeitY privacy materials (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Official sources

DPDPA textPrimary official law • en • html
MeitY privacy materialsSecondary official material • en • html

India