DPDP Act 2023 and DPDP Rules 2025: Rights, the Data Protection Board, Penalties and the RTI Debate

DPDP Act 2023 and DPDP Rules 2025: India's Data Protection Law

DPDP Act 2023: Key Terms, Seven Principles and Scope

Parliament passed the Act in August 2023, and it received the President's assent on 11 August 2023. It governs personal data collected in digital form, including data digitised from offline records, and follows what the government calls a SARAL design, simple, accessible, rational and actionable, with plain language and illustrations.

• Seven principles: Consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.
• Legitimate uses: Data may also be processed without fresh consent for certain uses, such as the specified purpose for which a person has voluntarily given her data.
• Cross-border transfer: The government may, by notification, restrict transfers to particular countries; transfers to other countries are not barred by this provision.

DPDP Rules 2025: Phased Commencement to May 2027

The government notified the DPDP Rules in mid-November 2025, after consultations in seven cities that drew 6,915 inputs. The Rules come into force in three stages.

• At once (November 2025): The definitions and the rules on the Data Protection Board, so that the Board can be set up.
• After one year (November 2026): The rule on registering Consent Managers, which must be Indian companies.
• After eighteen months (May 2027): Notices, security safeguards, breach reporting, children's data, data retention and the rights of Data Principals.

The Rules fill in the detail. Every fiduciary must give a standalone, plain-language consent notice and a contact for queries, report a breach to those affected without delay and to the Board within 72 hours, and answer requests within 90 days. Large platforms, such as e-commerce entities with at least two crore registered users, must erase data three years after a person last used the service, with some exceptions. Until May 2027, therefore, most of the obligations on fiduciaries are not yet binding.

Rights of Data Principals, Duties of Fiduciaries and Penalties

Consent and the Rights of the Data Principal

Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. A telemedicine app may ask for health details, but not for the phone's contact list, which the service does not need. Consent can be withdrawn at any time.

• Access and information: What data is held, why, and how it is used.
• Correction, updating and erasure: Fixing wrong data and removing data in certain situations; the statutory right to erasure rests largely on consent.
• Nomination: Naming someone to exercise these rights, for example in illness.
• Grievance redressal: A contact person at every fiduciary, and then the Board.

Children and persons with disabilities get extra protection. A fiduciary needs verifiable consent from a parent before processing a child's data, with limited exemptions for healthcare, education and real-time safety, and it may not track, behaviourally monitor or target advertising at children. In January 2026 UIDAI launched an Aadhaar app that lets platforms verify age for this purpose without sharing any other data.

Data Protection Board of India and the Penalty Schedule

The Data Protection Board of India, set up under section 18 as a body corporate, is an independent adjudicatory body. It inquires into breaches and non-compliance, issues directions, and imposes penalties, and it works as a digital institution where complaints are filed and tracked online. It has a Chairperson and four other Members, whose posts were advertised in May 2026, and appeals against its orders lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

The penalties depend on the breach. The highest, up to Rs 250 crore, is for failing to take reasonable security safeguards; up to Rs 200 crore each for not reporting a breach and for breaking the duties on children's data; up to Rs 150 crore for a Significant Data Fiduciary that breaks its extra obligations; and up to Rs 50 crore for any other breach. Individuals are not exempt: A Data Principal who breaches her own duties under section 15 can be fined up to Rs 10,000.

From Puttaswamy to the DPDP Act: The Personal Data Protection Bill

Right to Privacy, the Srikrishna Committee and the 2019 Bill

Article 21 says that no person shall be deprived of life or personal liberty except by the procedure established by law. Over time the Supreme Court has widened it to include the right to live with human dignity, free from exploitation, and the rights to shelter and livelihood, and privacy was the next step.

The law began with a judgment. On 24 August 2017 a nine-judge Bench in Justice K.S. Puttaswamy v. Union of India unanimously held that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms guaranteed by Part III. It overruled the earlier judgments in M.P. Sharma and Kharak Singh, which had held that there is no fundamental right to privacy.

• Srikrishna committee: A committee under Justice B.N. Srikrishna submitted its report and a draft Bill on data protection in July 2018.
• Personal Data Protection Bill, 2019: Referred to a Joint Parliamentary Committee, which reported in December 2021; the government withdrew the Bill on 3 August 2022.
• DPDP Bill, 2023: A fresh draft was released for consultation in November 2022; the Bill passed the Lok Sabha on 7 August and the Rajya Sabha on 9 August 2023.

The European Union's General Data Protection Regulation (GDPR), adopted on 14 April 2016 and applied from 25 May 2018, is the usual point of comparison for India's law, which covers personal data in digital form.

DPDP Act Controversies: RTI Amendment, State Exemptions and Surveillance

Section 44(3) and the RTI Act: The Constitution Bench Challenge

The sharpest dispute is over transparency. Section 8(1)⁠(j) of the Right to Information Act exempted personal information only when it had no link to public activity or interest, or would be an unwarranted invasion of privacy, and allowed disclosure where a larger public interest justified it. Section 44(3) of the DPDP Act replaced that clause with a plain exemption for any "information which relates to personal information".

• The challenge: Petitioners argue that the change lets public authorities refuse almost any request about officials, turning a right meant to protect citizens into a shield for the state.
• The government's view: The amendment codifies the privacy protection of Puttaswamy, and section 8(2) of the RTI Act, which allows disclosure in the public interest, still applies; the Attorney-General's opinion in January 2026 was that the Act did not dilute the RTI Act.
• In court: In February 2026 the Supreme Court referred the challenge to a Constitution Bench for its constitutional sensitivity, and in August 2026 it agreed to examine whether the law can be used to cripple the RTI Act.

State Exemptions, Surveillance and Other Criticisms

Section 17 lets the Union government exempt any instrumentality of the state from the Act by notification, on grounds that include the security of the state and public order, and the Act does not apply its main duties to processing for investigating or prosecuting offences. Critics note that the Puttaswamy test is framed around state action, while the Act lets the state exempt itself.

• Surveillance: No statute governs facial recognition systems, and the Act's processing duties are not yet in force.
• Journalism: Counsel argued in August 2026 that reporters must seek consent and data can be erased, while the Court said journalists are not a special category with unreserved access to data.
• Right to be forgotten: The Act offers only a limited right to erasure in section 12, based mainly on consent.
• Children: Because anyone under eighteen is a child, the consent rules reach teenagers' everyday use of platforms.

The Act also shapes India's other digital systems, from consent-based health records to Aadhaar-based age checks, which now have to be designed around its consent rules.

DPDP Act UPSC Relevance: GS Paper II and GS Paper III

Privacy, Data Protection and Governance in the UPSC and PCS Syllabus

The DPDP Act belongs to General Studies Paper II, under fundamental rights, government policies and statutory bodies, and to Paper III, under cyber security and technology. State PCS papers ask about the same law.

• Prelims facts: Assent 11 August 2023; Rules November 2025; full force May 2027; child under 18; Board under section 18 with appeals to the TDSAT; penalties up to Rs 250 crore; privacy under Article 21 (Puttaswamy, 2017); GDPR is the EU's law.
• Concepts: Data Principal, Data Fiduciary, Consent Manager, legitimate use, purpose limitation, data minimisation.
• Mains analysis: Context and salient features, privacy against transparency, state exemptions, and the scope of fundamental rights after Puttaswamy.