The DPDP Act in five minutes
India's Digital Personal Data Protection Act sets out how organisations may collect and use people's personal data, gives people rights over it, and creates a Board to enforce it. Here is what it means for a business, without the legal language.
Who it covers
Almost every business in India that keeps customer, staff or visitor details on a computer, phone or cloud service is covered. Size does not matter.
The people involved
- Data Principal
- the person the data is about: your customer, employee, patient or student.
- Data Fiduciary
- your business, when it decides why and how personal data is used.
- Data Processor
- a vendor that handles data for you, such as a cloud or payroll provider.
- Significant Data Fiduciary
- a business the Government names for extra duties because of the scale or risk of its processing.
- Consent Manager
- a registered service that lets people manage their consents in one place.
- Data Protection Board of India
- the body that inquires into breaches and complaints and imposes penalties.
The ideas behind it
- Use personal data lawfully, fairly and openly, with consent or a legitimate use.
- Use it only for the purpose you told people about.
- Collect only what that purpose needs.
- Keep it accurate and up to date.
- Keep it only as long as the purpose needs.
- Protect it with reasonable security safeguards.
- Be accountable: the business answers for how data is handled, including by its vendors.
Where to go next
- Check whether the Act applies to your business
- See the penalties and deadlines
- Look up a term in the glossary
This page is a plain-language summary, not legal advice.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.