India's Digital Personal Data Protection Act, 2023

1. 2017-08

   Puttaswamy judgment

   The Supreme Court holds privacy to be a fundamental right under Article 21, the foundation of later legislation.

2. 2019 to 2022

   Earlier bills withdrawn

   The Personal Data Protection Bill 2019 is withdrawn in August 2022 after a Joint Parliamentary Committee report.

3. 2023-08-11

   DPDP Act assented

   Passed by both Houses in a week; no commencement date set.

4. 2025-01

   Draft Rules for consultation

   MeitY publishes draft rules; consultation runs to March 2025.

5. 2025-11

   Rules notified

   Phase one in force immediately: definitions, the Data Protection Board, rule-making.

6. 2026-11

   Phase two

   Consent manager registration and related sections.

7. 2027-05

   Phase three

   Notice, consent, security, breach notification, data principal rights and the rest of the substantive duties.

What does the Act cover?

Digital personal data, meaning data about an identifiable individual that is collected digitally or digitised later, processed within India, or outside India in connection with offering goods or services to data principals in India. Personal data that the individual has made publicly available is excluded from most duties, as is data made available by someone else under a legal obligation. The Act does not define biometric or sensitive data and has no equivalent of GDPR Article 9; a face template is personal data like any other.

A data fiduciary (controller) needs consent, free and specific, after a notice in plain language and in any of the languages of the Eighth Schedule, or one of the listed legitimate uses. Data principals get rights to information, correction, erasure, grievance redress and nomination. Significant data fiduciaries, designated by the government by volume and sensitivity, owe audits and impact assessments. Children's data needs verifiable parental consent, and tracking or targeted advertising to children is barred.

Who enforces it?

The Data Protection Board of India, a digital-first adjudicating body appointed by the central government, inquires into breaches and imposes penalties; appeals go to the Telecom Disputes Settlement and Appellate Tribunal. There is no regulator with rule-making independence; the Ministry of Electronics and Information Technology makes the rules. The Board was constituted in phase one and had not published decisions by November 2026 because the substantive duties were not yet in force.

What are the penalties?

What does it mean for face search?

Two points pull in opposite directions. The exemption for data a person has made publicly available is wider than anything in the GDPR and gives face search engines an argument that photos a user posted on a public profile are outside the Act's consent duties. Against that, a face template is new data the engine creates, not data the person made public, and the Act's consent and notice duties would apply to an engine offering its service to people in India once phase three commences in May 2027. Indian users are a large share of traffic to PimEyes, FaceCheck.ID and similar engines, and FaceSearch and others serve India, so the 2027 deadline matters for all of them. Until then, the Information Technology Act and the IT Rules are the operative law, covered in the IT Act entry.

What is pending or unsettled?

• Whether a face template counts as data the principal made publicly available; the Act is silent and the Board has decided nothing.
• The government's power to exempt its own agencies and to restrict transfers to notified countries; both are criticised by the Internet Freedom Foundation and others as weakening the law.
• The Rules' amendment to the Right to Information Act, which removed the public-interest override for personal information, is under challenge and political dispute.