Every time you install an app, tick a checkbox or hand over your phone number, a data trail begins — and until recently, India had no single law with teeth to govern it. That changed with the Digital Personal Data Protection Act, passed in 2023 and made fully operational when the DPDP Rules, 2025 were notified in November 2025, kicking off a phased rollout that reaches full enforcement in May 2027. The law flips a long-standing arrangement: instead of companies collecting whatever they like and hoping you never ask, your personal data now belongs, legally, to you — and every app, bank, e-commerce site and social platform must ask before taking it, explain what it will do with it, and give it back or delete it on request. Here is what the DPDP Act actually gives you, what it demands from the apps you use, and how to make both work in your favour.
The cast of the new data economy
The law works through three roles, and knowing them makes everything else fall into place. You are the Data Principal — the person the data is about, with children and people with lawful guardians acting through their parents or guardians. The company or app collecting your data is the Data Fiduciary, the party responsible for deciding how and why your information is processed. Between them sits a newer invention, the Consent Manager, a registered, independent platform where you can give, review and withdraw consent across multiple companies from a single account, rather than chasing each app separately.
The Data Protection Board of India rounds out the system as the enforcement body. It investigates complaints, directs remediation and, crucially, can impose financial penalties — the Act deliberately avoids criminal prosecution and relies instead on fines steep enough to change corporate behaviour.
What the Act demands from apps and platforms
For the companies you deal with daily, the obligations are concrete rather than aspirational. Consent must be free, specific, informed and unconditional, delivered through a clear notice that spells out exactly which data is collected and for which purpose — no more burying everything under a single «accept all» tap with vague language. Withdrawing consent must be as easy as giving it, and once withdrawn, the company must stop processing and erase the data unless a separate law requires it to keep it.
The rules around security and breaches are the sharpest teeth in the law. A company that fails to maintain reasonable safeguards faces fines of up to ₹250 crore — roughly ₹2.5 billion — per instance, and this applies regardless of intent. If a breach does occur, the company must notify both the Board and affected users without delay, followed by a detailed report within 72 hours of becoming aware of the breach; failure to notify separately attracts penalties of up to ₹200 crore. Requests for access, correction or erasure must be handled within published timelines, generally capped at 90 days, and there are dedicated officers and grievance mechanisms that companies must maintain.
Your rights as a Data Principal
This is the part of the law written for you, and it is worth knowing precisely, because these rights are enforceable, not decorative:
- Right to access. You can demand a summary of what personal data a company holds about you, how it is processing it, and who else it has been shared with.
- Right to correction and erasure. Inaccurate or incomplete data must be fixed, and you can ask for deletion once the original purpose is served or after you withdraw consent — unless retention is required by law.
- Right to withdraw consent. At any moment, for any reason, without penalty, and the app must make the withdrawal path as convenient as the consent path.
- Right to grievance redressal. If a company mishandles a request, you can complain through its own mechanism first, then escalate to the Data Protection Board.
- Right to nominate. You can appoint someone to exercise your data rights in case of death or incapacity — a quietly important provision for digital legacies.
One caveat keeps the system fair: these duties cut both ways. Submitting false or frivolous complaints can cost the complainant up to ₹10,000, so the Board expects good faith from individuals just as it expects compliance from companies.
Penalties at a glance
The fine schedule is what turns the Act from a code of conduct into something with consequences. Each cap applies per violation, and the Board weighs severity, the type of data involved, repetition and how cooperative the company was when deciding the amount:
| Violation | Maximum penalty |
|---|---|
| Failure to maintain reasonable security safeguards leading to a breach | ₹250 crore |
| Failure to notify the Board and affected users of a breach | ₹200 crore |
| Breach of obligations around children’s data | ₹150–200 crore |
| Other contraventions of the Act | ₹50 crore |
| False or frivolous complaints by users | ₹10,000 |
The asymmetry is deliberate. A single lapse in security infrastructure can cost a company more than years of revenue, which is exactly the incentive the drafters wanted. Meanwhile the penalty on users is nominal — a deterrent against weaponised complaints rather than a barrier to legitimate ones.
Children get a special shield
Among the strictest provisions in the law is Section 9, which treats anyone under 18 as a protected category. Apps and platforms cannot process a child’s data without verifiable consent from a parent or lawful guardian, and even after consent is obtained, tracking, behavioural monitoring and targeted advertising directed at children are flatly prohibited. Some exceptions exist for healthcare, education and child-safety services, but the default is protective. For parents, this means the apps your children use are now legally obligated to run age gates and parental consent flows; for teenagers, it means their feeds are not legally allowed to be shaped by behavioural profiling the way adult feeds are.
Where your data can travel
The Act takes a blacklist approach to cross-border transfers rather than forcing data to stay within India. By default, companies may send your personal data to other countries, except those the government specifically notifies as restricted. What they must maintain is a continuous, up-to-date map of where data actually flows — so when a jurisdiction lands on the restricted list, transfers there stop immediately. For most users this is invisible plumbing, but it matters for everything from cloud backups to customer support agents located abroad.
How the phased timeline affects what you see
Compliance is arriving in stages, and each phase changes what you notice as a user:
- Phase 1 (from November 2025): the Data Protection Board became operational, definitions and government powers took effect, and the Board was designated as the primary adjudicatory body for data disputes.
- Phase 2 (from November 2026): registration and functioning of Consent Managers, along with obligations for Significant Data Fiduciaries — the large platforms handling massive volumes of sensitive data — come into force.
- Phase 3 (by May 2027): all substantive obligations activate in full, including notices, security safeguards, rights handling, breach reporting and the complete penalty schedule.
In practical terms, the transition period is now. Apps are rebuilding their consent flows, deleting old databases that no longer have a stated purpose, and preparing for the day when every request you file carries a statutory deadline behind it.
What you should do differently right now
Knowing the law is one thing; using it is another. A few habits translate the Act from paper into protection:
- Read consent notices for a few seconds longer, especially the purpose list — if a torch app wants your contacts, the notice should tell you so before you agree.
- Use the withdrawal and erasure rights deliberately: for apps you no longer use, request deletion rather than just uninstalling.
- Watch for the Consent Manager ecosystem as it matures, since a single dashboard for your consents across services will make auditing your digital footprint realistic for the first time.
- When an app or bank mishandles your data, document the complaint trail — the Board’s process rewards users who can show what they asked and when.
- For accounts holding sensitive data — banking, health, government services — enable the strongest authentication available, because even the best law cannot undo a compromised password.
None of these steps requires technical expertise; they simply assume what the Act itself assumes — that data belongs to the person it describes.
A shift in the balance of power
The DPDP Act does not make the internet frictionless — consent notices will multiply, and some services will feel slower to onboard. What it does change is the direction of accountability. Companies now operate under a consent-first regime with penalties large enough to make data governance a boardroom topic, and individuals hold enforceable rights with a regulator standing behind them. As the phases complete through 2027, the measure of the law will be visible in small moments: a clearer notice, a delete button that actually deletes, a breach you hear about from the company rather than from the news. Those small moments, repeated across a billion digital lives, are what a data privacy law is ultimately for.