apac
India
India's Digital Personal Data Protection Act introduces a new national framework, but public analysis still depends heavily on implementation rules and phased operationalization.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
medium confidence, Implementation remains partial and rule-dependent, so field-level caution is needed until operational rules and regulator practice mature.
Breach
- Breach deadline (hours)
- 0
- Breach notification required
- Yes
Marketing
- Cookie consent rule
- Consent-driven digital tracking analysis will likely evolve alongside DPDPA implementation rules.
Transfers
- Cross-border transfer restricted
- Yes
- Data localization required
- No
Governance
- DPO required
- Yes
- Impact assessment required
- No
- Records of processing required
- No
Identity
- Effective date
- 2023-08-11
- Effective status
- partial
- Last amended
- 2023-08-11
- Law status
- active
Scope
- Extraterritorial application
- Yes
- Private sector coverage
- Applies broadly to data fiduciaries processing digital personal data.
- Public sector coverage
- Public bodies may also be covered, subject to statutory exemptions and government notifications.
- Territorial scope
- Applies to digital personal data processing in India and to overseas processing tied to offering goods or services to individuals in India.
Legal Basis
- Legal bases
- consent, legitimate use
- Requires legal basis
- Yes
Enforcement
- Maximum fine
- The Act contemplates significant administrative monetary penalties for specified violations.
- Private right of action
- No
- Regulator or enforcement authority summary
- Data Protection Board of India
Definitions
- Personal data definition
- Personal data means any data about an individual who is identifiable by or in relation to such data.
- Sensitive data recognized
- No
Rights
- Right of access
- Yes
- Right to appeal
- Yes
- Right to deletion
- Yes
- Right to erasure or delete summary
- Emerging erasure / deletion structure
- Right to object
- No
- Right to portability
- No
- Right to rectification or correction summary
- Correction / completion rights
Official sources
- DPDPA textPrimary official law • en • html
- MeitY privacy materialsSecondary official material • en • html