Digital Personal Data Protection Act, 2023: notes for bank exams

At a glance

The DPDP Act, 2023 sets rules for how organisations collect and use people's digital personal data. It gives individuals rights over their data, puts duties on the businesses and government bodies that handle it, and creates the Data Protection Board of India to hear complaints and impose penalties. Its Rules were notified in November 2025, and most duties apply from 13 May 2027.

Key facts

Ministry: Ministry of Electronics and Information Technology (MeitY)
Passed: Lok Sabha 7 August 2023, Rajya Sabha 9 August 2023; Presidential assent 11 August 2023
Rules: DPDP Rules, 2025, notified 13 November 2025
Applies to: digital personal data processed in India, and processing abroad if it involves offering goods or services to people in India
Data Principal: the person the data is about; Data Fiduciary: the entity that decides why and how data is processed
Significant Data Fiduciary: notified by the Centre based on volume and sensitivity; extra duties (Data Protection Officer in India, audits, impact assessments)
Children: anyone under 18; processing needs verifiable parental consent
Regulator: Data Protection Board of India (adjudicating body); appeals go to TDSAT
Maximum penalty: ₹250 crore (failure to take reasonable security safeguards)
Penalty on a Data Principal for breaching own duties: up to ₹10,000

How it works

Consent and legitimate uses. Data may be processed with free, specific, informed and unambiguous consent, given after a clear notice. Consent can be withdrawn as easily as it was given. Some "legitimate uses" do not need consent, such as government benefits, legal duties, medical emergencies and employment.

Rights of Data Principals. Access to information about their data, correction and erasure, grievance redressal and nominating someone to act for them after death or incapacity. They also have duties, such as not filing false complaints.

Consent Managers. Registered entities that let people give, manage and withdraw consent across fiduciaries through one platform.

Penalties (Schedule to the Act).

Breach	Maximum penalty
No reasonable security safeguards	₹250 crore
Failure to notify a data breach to the Board and affected people	₹200 crore
Breach of obligations for children's data	₹200 crore
Breach of extra duties of a Significant Data Fiduciary	₹150 crore
Any other breach	₹50 crore
Data Principal breaching own duties	₹10,000

Phased timeline under the 2025 Rules.

Phase	From	What applies
Immediate	13 Nov 2025	Data Protection Board set up; its procedures in force
12 months	13 Nov 2026	Registration of Consent Managers
18 months	13 May 2027	Notice, consent, security, breach notification, rights, penalties

Timeline

2017: Supreme Court's Puttaswamy judgment holds privacy a fundamental right under Article 21
2018: Justice B. N. Srikrishna Committee submits a draft data-protection bill
2019: Personal Data Protection Bill introduced (withdrawn in 2022)
2023: DPDP Act passed (assent 11 August)
2025: DPDP Rules notified (13 November)
2026: MeitY invites applications for the Board's Chairperson and Members (May)

Recent developments

21 Oct 2026: SBI said 3,897 customer records were among about 3.75 lakh records found on the dark web; commentators noted that the DPDP breach-notification duty applies fully only from May 2027.

Exam traps

The Data Protection Board adjudicates; it is not an "Authority" (the 2019 Bill had a Data Protection Authority).
Appeals against the Board lie to TDSAT, not to a High Court directly.
The top penalty of ₹250 crore is for failing to keep security safeguards, not for breach notification (₹200 crore).
A "child" under the Act is anyone under 18, not 13 or 16.
CERT-In (under the IT Act, 2000) handles cyber incidents; the DPDP Board handles personal-data breaches. They are different bodies.

Quick check

Q: What is the maximum penalty under the DPDP Act, 2023? A: ₹250 crore.
Q: When were the DPDP Rules notified? A: 13 November 2025.
Q: Where does an appeal against an order of the Data Protection Board lie? A: TDSAT.

Sources

In the news

Every time this topic has appeared in our current affairs, newest first:

26 October 2026SBI confirms 3,897 customer records leaked on the dark web