What Is India Digital Personal Data Protection Act?
India Digital Personal Data Protection Act is the Digital Personal Data Protection Act 2023 (DPDPA), India's first comprehensive data protection law, governing the processing of personal data by data fiduciaries.
India Digital Personal Data Protection Act — the Digital Personal Data Protection Act 2023 (DPDPA), India's first comprehensive data protection law, governing the processing of personal data by data fiduciaries.
The DPDPA applies to processing of digital personal data in India and to processing outside India where Indian residents are involved. Key AI governance implications: consent requirements for automated processing, rights to information about how data is used, grievance redressal obligations, and sector-specific rules expected under delegated powers. The Data Protection Board of India will oversee enforcement. As of 2026, the implementing rules were being finalised by the Ministry of Electronics and Information Technology (MeitY).
Source: Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Plain-language explanation
The DPDPA applies to processing of digital personal data in India and to processing outside India where Indian residents are involved. Key AI governance implications: consent requirements for automated processing, rights to information about how data is used, grievance redressal obligations, and sector-specific rules expected under delegated powers. The Data Protection Board of India will oversee enforcement. As of 2026, the implementing rules were being finalised by the Ministry of Electronics and Information Technology (MeitY).
See where you stand on AI governance
Take the free 7-question maturity assessment and get a personalised action plan.
Free assessment — 3 minutes →