DPDP Act 2023: Digital Personal Data Protection, Consent Manager and the Data Protection Board

The DPDP Act 2023 — the Digital Personal Data Protection Act, notified by Parliament on 11 August 2023 — is India’s first horizontal personal-data statute. It replaces a patchwork built on Section 43A of the Information Technology Act 2000 and the SPDI Rules 2011 with a single regulatory frame applicable to every entity that processes digital personal data in India. For UPSC General Studies II, the DPDP Act 2023 is the legislative answer to the Supreme Court’s nine-judge verdict in K.S. Puttaswamy v. Union of India (2017), which held that informational privacy is a fundamental right under Article 21. The Act is operationally significant because of its tight definition of consent, the new statutory persona called the Consent Manager, the obligations on Data Fiduciaries, and the centralised enforcement architecture of the Data Protection Board of India.

Origin: the Justice Srikrishna report

The trajectory of the DPDP Act 2023 begins with the Srikrishna Committee. After the Puttaswamy judgment in August 2017, the Union government constituted a committee of experts chaired by Justice B.N. Srikrishna, retired judge of the Supreme Court. The committee submitted its report titled A Free and Fair Digital Economy in July 2018, along with a Personal Data Protection Bill 2018.

The Srikrishna framework was deliberately Indian — it borrowed the GDPR’s structural ideas but rejected several of them. The committee proposed a four-fold classification (personal, sensitive personal, critical, and child-related), a hard data-localisation regime for sensitive and critical categories, a Data Protection Authority with regulatory and adjudicatory powers, and significant fines tied to global turnover.

The Personal Data Protection Bill 2019 was tabled in Parliament, referred to a Joint Parliamentary Committee that took two years and ten extensions to report, and re-emerged in 2021 as the Data Protection Bill 2021 covering non-personal data too. That bill was withdrawn on 3 August 2022. A leaner Digital Personal Data Protection Bill was tabled in November 2022 as a consultation draft, formally introduced as the DPDP Bill 2023, passed by Parliament in August 2023, and notified as the DPDP Act 2023 on 11 August 2023. The implementing DPDP Rules were notified in draft form in January 2025.

Scope and definitions

The Act applies to processing of “digital personal data” within India and to processing outside India if it is in connection with offering goods or services to data principals within India. “Personal data” is data about an identified or identifiable individual. “Processing” is broadly defined — any automated operation on data including collection, storage, retrieval, use, alignment, disclosure, erasure or destruction.

The Act does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data made publicly available by the data principal herself or by any other person under a legal obligation to make it public.

Key statutory personae

• Data Principal — the individual to whom the personal data relates. Where the individual is a child (under 18) or a person with a disability with a lawful guardian, the parent or guardian is included.
• Data Fiduciary — any person who, alone or in conjunction with others, determines the purpose and means of processing personal data. This is the regulated entity.
• Data Processor — a person who processes data on behalf of a Data Fiduciary.
• Significant Data Fiduciary — a class of Data Fiduciaries notified by the central government on the basis of volume and sensitivity of data, risk of harm and other factors, subject to enhanced obligations.
• Consent Manager — a registered entity that enables a Data Principal to give, manage, review and withdraw her consent through an interoperable platform. The Consent Manager is accountable to the Data Principal.

Consent and the lawful bases

Consent under Section 6 of the DPDP Act 2023 must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action. The notice that accompanies the consent request must be in English and in any language listed in the Eighth Schedule that the data principal chooses, and must list the personal data to be processed, the purpose of processing, the manner of exercising data-principal rights, and the manner of complaining to the Data Protection Board.

The Act recognises “certain legitimate uses” under Section 7 — narrower than the GDPR’s “legitimate interest” — for which consent is not required. These include voluntary provision by the data principal for a specified purpose, performance of state functions under law, compliance with law or court order, response to medical emergency, employment-related purposes, and a few others. The list is closed.

Consent Manager: the novel piece

The Consent Manager is the most distinctive feature of the DPDP Act 2023. The Data Principal interacts with multiple Data Fiduciaries; managing consents across a fragmented ecosystem is impractical. The Consent Manager is registered with the Data Protection Board and operates an interoperable platform on which the Data Principal can view her consents, revoke them, and audit which Data Fiduciary received which category of data for what purpose. The architecture borrows directly from the Account Aggregator regime in financial services. The DPDP Rules 2025 specify net-worth, technical and audit requirements for Consent Managers.

Obligations of the Data Fiduciary

Section 8 sets out the operational duties. The Data Fiduciary must:

• ensure completeness, accuracy and consistency of personal data used in decisions that affect the data principal;
• implement appropriate technical and organisational measures for data security;
• protect against personal data breach by reasonable security safeguards;
• notify the Board and affected data principals of any personal data breach;
• erase personal data when consent is withdrawn or the purpose is no longer being served, unless retention is required by law;
• publish the business contact information of a Data Protection Officer (for Significant Data Fiduciaries) or another responsible person;
• establish an effective grievance redressal mechanism with stated turnaround times.

Section 9 requires that for children’s data, processing be on the basis of verifiable parental consent and that no tracking, behavioural monitoring or targeted advertising be directed at children. The central government may exempt particular Data Fiduciaries or classes for specified purposes such as health and education.

Significant Data Fiduciary obligations

A Significant Data Fiduciary under Section 10 has additional duties — appointing a Data Protection Officer based in India and answerable to the board of directors, appointing an independent data auditor, undertaking periodic data protection impact assessments, and periodic audit. The Act also empowers the central government to specify cross-border restrictions for SDFs, replacing the earlier Bill’s broader localisation language.

Rights of the Data Principal

The Act creates four core rights — narrower than the GDPR but comprehensive enough to be operational.

• Right to access information about personal data (Section 11). The Data Principal can obtain a summary of personal data being processed, the processing activities, the identities of all other Data Fiduciaries with whom her data has been shared, and a description of the shared data.
• Right to correction and erasure (Section 12). The Data Principal can have inaccurate or misleading data corrected, incomplete data completed, outdated data updated, and personal data erased when it is no longer needed.
• Right to grievance redressal (Section 13). The Data Principal must first approach the Data Fiduciary or Consent Manager. Only after exhausting that channel can she approach the Board.
• Right to nominate (Section 14). A Data Principal can nominate another individual to exercise her rights in the event of death or incapacity.

The Act also imposes duties on the Data Principal under Section 15 — comply with applicable laws, not register false complaints, and not provide false or misleading information. Breach of these duties attracts a penalty up to ₹10,000.

Data Protection Board of India

The Board, established under Section 18, is the single enforcement institution. It is composed of a Chairperson and members appointed by the central government for two years, eligible for re-appointment. Selection is from persons of ability, integrity and standing with specialised knowledge in data governance, law, regulation, dispute resolution, IT, digital economy and consumer protection. Of these, at least one member must be an expert in law.

The Board’s functions are inquiry into complaints, breach notifications and reference from the central government; direction for remedial action; imposition of monetary penalties listed in the Schedule (up to ₹250 crore for failure to prevent a breach, up to ₹200 crore for failure on children’s-data obligations, and so on); and reference to alternative dispute resolution where appropriate.

The Board operates as a digital-by-design body — proceedings are paperless, hearings are by video conference, and orders are uploaded to the portal. Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal under Section 29.

Independence concerns

Critics — including Justice Srikrishna himself — have questioned the structural independence of the Board. The Chairperson and members are appointed by the central government without a multi-stakeholder selection committee comparable to those for the Central Information Commission under the RTI Act 2005. The two-year term is too short for institutional independence. The central government also retains power to issue directions to the Board in matters of public interest, a provision absent in the original Srikrishna draft.

DPDP and the RTI Act

The DPDP Act 2023 amends Section 8(1)(j) of the RTI Act 2005 — the personal-information exemption. The earlier wording exempted personal information “which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual,” with a public-interest override. The 2023 amendment removes the qualifier “which has no relationship to any public activity or interest” — leaving a broader privacy-based exemption. Civil-society groups have warned this could shrink investigative journalism into the public conduct of public officials and reduce transparency in election-finance and beneficiary-list data.

How DPDP compares with GDPR

The structural similarities are real — both impose obligations on the data controller (Data Fiduciary), both give individuals access, correction and erasure rights, and both rely on a regulatory institution for enforcement. The differences are also real:

• Lawful bases — GDPR Article 6 has six bases (consent, contract, legal obligation, vital interests, public task, legitimate interest). DPDP has two (consent and listed legitimate uses) with a closed list, making it narrower in effect.
• Sensitive data — GDPR Article 9 has special-category data (health, biometrics, sexual orientation, religion) with stricter rules. DPDP treats all personal data uniformly, with extra obligations only on Significant Data Fiduciaries.
• Cross-border transfer — GDPR requires adequacy decisions, SCCs or BCRs. DPDP empowers the central government to issue a “blacklist” of countries to which transfer is restricted; the default is permissive.
• Data Protection Impact Assessment — mandatory under GDPR Article 35 for high-risk processing. Under DPDP, mandatory only for Significant Data Fiduciaries.
• Penalties — GDPR up to 4 per cent of global turnover or €20 million. DPDP fixed schedule, up to ₹250 crore per instance.
• Right to be forgotten / data portability — express right under GDPR; DPDP has erasure but no separate portability right.
• Independence of regulator — GDPR requires complete independence of supervisory authorities. DPDP Board is centrally appointed.

Exemptions for the state

Section 17 of the DPDP Act 2023 empowers the central government to exempt any instrumentality of the state from the provisions of the Act in the interests of sovereignty and integrity of India, security of the state, friendly relations with foreign states, maintenance of public order, or prevention of incitement to commission of cognisable offences. The notification under this provision is non-justiciable on its face. Civil-liberty groups argue this is the single largest unaddressed concern from the Srikrishna report, which had recommended ex-ante judicial oversight of state surveillance.

The Act also exempts processing for research, archiving or statistical purposes from most of its provisions, subject to prescribed standards.

Where the regime is heading

The DPDP Rules 2025 will operationalise the Act through 2026. The Data Protection Board has begun functioning from its Delhi seat. The first cohort of Consent Managers is undergoing registration. The first Significant Data Fiduciary notification will set the regulatory tone for the digital-economy giants. The pending Article 21 challenge to Section 17 exemptions will test how the DPDP Act 2023 interacts with the Puttaswamy privacy framework.

For aspirants, the DPDP Act 2023 is a textbook test of how a constitutional right (privacy under Article 21) is operationalised into a statute, how Indian drafting adapts a European model, and how regulatory institutions are designed for a federal digital economy.

Frequently Asked Questions