DPDP Act 2023 Compliance Starter

A practical Act-level starting point for Indian startups handling personal data.

Digital Personal Data Protection Act 2023

Assent: 11 August 2023

Current status

Enacted; operationalisation pending DPDP Rules notification by MeitY

VERIFY

DPDP Rules had not been notified as of Aug 2026. The Act is in force but many provisions apply only after rules are made. Check MeitY website for latest notification status.

personal Data

Any data about an individual who is identifiable by or in relation to such data (s.2(t)). Includes name, address, email, phone, IP address, device ID.

data Fiduciary

Any person who alone or in conjunction with other persons determines the purpose and means of processing personal data (s.2(i)). Includes any startup or company collecting user data.

data Processor

Any person who processes personal data on behalf of a Data Fiduciary (s.2(j)). E.g., cloud provider, analytics vendor.

data Principal

The individual to whom the personal data relates (s.2(k)). The user/customer.

consent Manager

A body registered with the Data Protection Board that enables individuals to give, manage, review and withdraw consent (s.2(e)).

VERIFY

Whether 'sensitive personal data' as a distinct category remains under DPDP Act 2023 — the Act does NOT separately define sensitive personal data unlike earlier PDPB drafts. All personal data is treated uniformly. Only children's data gets heightened protection. Confirm with counsel whether this is still the position in the notified Rules.

VERIFY

DPDP Rules had NOT been notified as of Aug 2026. The Act is in force but many critical thresholds (retention period, breach notification timeline, consent manager specifications) are specified in the Rules. This tool provides the Act-level framework only — review and update all VERIFY items when Rules are notified by MeitY. DPDP compliance is an evolving area; engage a privacy counsel for the final privacy policy and DPAs.

Statutory basis: Digital Personal Data Protection Act 2023 (DPDP Act 2023) + MeitY DPDP Rules (yet to be notified as of Aug 2026); ss.2, 4, 5, 6, 7, 8, 9, 10, 13, 14, 15, 16, 17, 40, 66