DPDP Glossary
DPDP Act
The Digital Personal Data Protection Act, 2023 — India’s primary statute for processing of digital personal data.
Act No. 22 of 2023
What it means
The Digital Personal Data Protection Act, 2023 is India’s primary statute governing processing of digital personal data. It defines actors (Principal, Fiduciary, Processor, Consent Manager), processing grounds, rights, duties, children’s provisions, Board powers and penalties. Rules under Section 40 supply operational detail; they do not replace the Act.
Worked example
When a product team asks “what does DPDP require for consent?”, the answer starts in Sections 4–6 of the Act, then maps to Rule 3 notice detail once commenced — not in a GDPR checklist pasted into an Indian privacy policy.
In practice
Use the Act for definitions and duties; use the Rules for how certain obligations operate in practice. Track commencement notifications so you do not treat every Rule as already enforceable on the same date. Start from the hub overview for orientation.
Source
Act No. 22 of 2023 · Official text (PDF)
Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.