Digital Personal Data Protection Act 2023 (DPDP Act) Act No. 22 of 2023 was passed by the Indian Parliament + received the assent of President Droupadi Murmu on 11 August 2023 + published in the Gazette of India Extraordinary Part II Section 1 on 12 August 2023. India first comprehensive personal data protection law providing a statutory framework for processing digital personal data within India. Constitutional basis: 9-judge Supreme Court Constitution Bench unanimous judgement in Justice K.S. Puttaswamy (Retd.) v. Union of India + Anr. (2017) 10 SCC 1 declaring Right to Privacy as a fundamental right under Article 21 of the Constitution. The Act repeals Section 43A of Information Technology Act 2000 and IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules) which previously governed personal data. Section 1 Short Title + Extent + Commencement: extends to whole of India + applies to processing of digital personal data within the territory of India where such personal data is collected (a) in digital form or (b) in non-digital form and digitised subsequently + applies to processing of digital personal data outside the territory of India if such processing is in connection with any activity related to offering of goods or services to Data Principals within India (extraterritorial application). Section 2 Definitions includes 43 key definitions including Adjudicating Officer + Appellate Tribunal (TDSAT) + Automated decision-making + Board (Data Protection Board of India DPBI) + Certificate + Certification + Child (defined as individual under 18 years of age) + Consent + Consent Manager + Data + Data Fiduciary + Data Principal + Data Processor + Digital Personal Data + Person + Personal Data + Personal Data Breach + Processing + Significant Data Fiduciary + Standard Contractual Clauses + State + Status. Section 3 covers Application of Act + Exemptions (research + archiving + statistical purposes + national security + crime prevention + Reserve Bank of India + court proceedings + small-scale exemptions for startups). DPDP Rules 2025: notified by MeitY post-Act commencement covering operational detail including manner of notice + consent + Consent Manager registration + Significant Data Fiduciary determination + Data Protection Board procedures + appeal processes + penalties calculation methodology + cross-border transfer mechanisms. Public + freely available via meity.gov.in + egazette.gov.in. Governance: MeitY Government of India + Data Protection Board of India (DPBI) + Telecom Disputes Settlement and Appellate Tribunal (TDSAT) as Appellate Tribunal + adjudicating officers. Coordinates with Indian Constitution Article 21 + Puttaswamy + Information Technology Act 2000 + IT Rules 2013 + CERT-In Directions 2022 + RBI Cyber Security Framework + RBI Account Aggregator Framework + Aadhaar Act 2016 + Telecommunications Act 2023 + IT Intermediary Guidelines 2021 + DPI India Stack + GDPR + UK GDPR + Singapore PDPA + Australia Privacy Act + APEC CBPR + Convention 108 (where applicable). DPDP Act + Scope + Definitions + 11 August 2023 + Constitutional Privacy applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.