Digital Personal Data Protection Act 2023
Digital Personal Data Protection Act 2023
12 min read · Updated 2026-05-25
What is the Digital Personal Data Protection Act?
The Digital Personal Data Protection Act, 2023 is India's first comprehensive personal-data law, notified on 11 August 2023. It lets a data fiduciary process personal data only with free, specific, informed and unambiguous consent or for listed legitimate uses, gives the data principal rights of access, correction, erasure and nomination, and lets the Data Protection Board of India fine up to ₹250 crore.
The story
In August 2017, a nine-judge bench of the Supreme Court was hearing a quiet challenge to the Aadhaar project. The petitioner, retired Justice K.S. Puttaswamy, was 92 years old. His question was disarmingly simple: does the Constitution recognise a right to privacy?
In a 547-page judgment, the Court answered yes — privacy is a fundamental right under Articles 14, 19 and 21. Justice D.Y. Chandrachud, writing for four of the nine judges, said informational privacy was an "essential facet" of human dignity. The judgment also did something extraordinary: it directed the Union government to enact a comprehensive data protection law.
Six years, three draft bills, and one mass public consultation later, the Digital Personal Data Protection Act, 2023 was notified on 11 August 2023. The law is short — just 44 sections. It borrows ideas from the EU's GDPR but pares them down for Indian realities. It also creates a Data Protection Board with the power to fine offending entities up to ₹250 crore per breach. This is the story of how India finally got a privacy law — and why critics say it gives the State too much room to look the other way.
Why this matters for UPSC
Data protection is the highest-frequency tech-policy topic in recent UPSC papers — at least one Prelims question in 2023 and 2024, multiple Mains questions on privacy, surveillance, and digital rights, and standard Interview fodder for any candidate with a tech background. The topic intersects Polity (fundamental rights, Article 21), Internal Security (data localisation, surveillance), and Economy (compliance costs, digital trade).