CyberFreezeDev
Loading
India's personal data law: collect for a stated purpose, protect it, delete it when done.
It covers digital personal data processed in India, or abroad to serve people in India. As Data Fiduciary, your business stays answerable for its vendors.
The Digital Personal Data Protection Act, 2023 received assent in August 2023. It covers personal data processed in digital form in India, and personal data processed outside India when it is for offering goods or services to people in India. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and bring most of the duties into force in phases, with the bulk applying 18 months after notification.
The Act uses its own words. The person the data is about is the Data Principal. The business that decides why and how data is processed is the Data Fiduciary. A vendor that processes data for it, such as a software provider or an AI developer, is a Data Processor, and the fiduciary stays answerable for what the processor does.
Tell people what you collect and why, get clear consent, and let them withdraw easily.
Give a clear notice of what data you collect and why, and get consent that is free, specific and unambiguous, or rely on one of the legitimate uses the Act lists. People can withdraw consent as easily as they gave it.
Use data only for the stated purpose and erase it once that purpose is served.
Use data only for the purpose given, and erase it when that purpose is served, unless another law requires you to keep it.
Take reasonable security safeguards to prevent a breach, at your vendors too.
Take reasonable security safeguards to prevent a breach, including at your vendors.
Tell the Board and affected people; the detailed report is due within 72 hours.
Inform the Data Protection Board and each affected person of a personal data breach. The Rules set the content and a 72-hour window for the detailed report to the Board.
Under 18s need verifiable parental consent, and no tracking or targeted ads.
For anyone under 18, get verifiable consent from a parent or guardian, and do not track or target advertising at children.
Let people access, correct and erase their data, with a named contact for questions.
Let people access, correct and erase their data, and name a contact who answers questions about it.
The Board can impose penalties of up to ₹250 crore for weak security, and up to ₹200 crore for unreported breaches or children's data failures.
The Data Protection Board can impose penalties set out in the Act's Schedule. The largest, up to ₹250 crore, is for failing to take reasonable security safeguards. Failing to report a breach or to meet the duties on children's data can each draw up to ₹200 crore. Read the Act itself on India Code for the full list.
Your business is the fiduciary, the AI vendor a processor. Record consent at entry, be able to delete one person's data, and know where it is processed.
When a clinic sends patient messages to a chatbot, or a CA firm runs client documents through OCR, the business is the data fiduciary and the AI vendor is a processor. Three design choices follow. Record consent where the data enters, for example on the WhatsApp opt-in or the booking form. Keep a way to find and delete one person's data across every system it reached. And know where the data is processed: the Act does not impose general data localisation, but the government can restrict transfers to named countries, and sector regulators may have their own rules.
That last point is a common reason clients choose private AI deployment, where the model runs on hardware they control. See also our pages for clinics and AI governance.
Yes. There is no general size exemption for data fiduciaries, though the government can exempt classes of fiduciaries, including startups, from some duties by notification.
The Act was passed in 2023 and the Rules were notified in November 2025. The Data Protection Board provisions started first; most business duties apply after the 18 month phase-in. Plan for them now.
Only if the data is digitised later. Personal data collected on paper and never digitised is outside the Act.
Last updated