The DPDP Act, 2023 is an Act of the Parliament of India. It provides for the processing of digital personal data in a way that recognises both the right of individuals to protect their personal data and the need to process such data for lawful purposes.Wikipedia
In 2017, the Supreme Court held the right to privacy to be a fundamental right under Article 21. The Digital Personal Data Protection Bill, 2022 was released for public consultation in November 2022.Wikipedia
Consent Managers let Data Principals give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.PIB
Digital Personal Data Protection Act, 2023: quick facts
- Full name
- Digital Personal Data Protection Act, 2023 (DPDP Act, 2023)
- Presidential assent
- 11 August 2023, after passage by Lok Sabha (7 August 2023) and Rajya Sabha (9 August 2023)
- Adjudicating body
- Data Protection Board of India (established under section 18 of the Act)
Key facts
| Full name | Digital Personal Data Protection Act, 2023 (DPDP Act, 2023)Wikipedia |
|---|---|
| Presidential assent | 11 August 2023, after passage by Lok Sabha (7 August 2023) and Rajya Sabha (9 August 2023)Wikipedia |
| Adjudicating body | Data Protection Board of India (established under section 18 of the Act)Wikipedia |
| Consent Manager net worth | Not less than ₹2 crore, plus adequate technical, operational and financial capacityPIB |
Key features and how it works
- Recognises the right of individuals (Data Principals) to protect their personal data and the need to process it for lawful purposes.Wikipedia
- The Data Protection Board of India is an adjudicating body that can inquire into personal data breaches and impose penalties.Wikipedia
- Consent Managers are registered with the Data Protection Board. They enable Data Principals to give, manage, review and withdraw consent through a platform that is accessible, transparent and interoperable, and they are accountable to Data Principals.PIB
- Applications for Consent Manager registration are filed online at dpbi.gov.in. The list of registered Consent Managers will be made publicly available on the Board's website.PIB
Eligibility and rules
- Consent Manager registration: the applicant must be a company incorporated in India, with a net worth of not less than ₹2 crore and adequate technical, operational and financial capacity. Applications are filed online at dpbi.gov.in, which opened on 13 November 2026.PIB
Static GK
- Data Protection Board of India: established under section 18 of the DPDP Act, 2023, on 13 November 2025. It is an adjudicating body that can inquire into personal data breaches and impose penalties.Wikipedia
- Ministry of Electronics and Information Technology (MeitY): made a full ministry on 19 July 2016, after the Department of Electronics and Information Technology was split from the Ministry of Communications and Information Technology.Wikipedia
- Puttaswamy judgment (24 August 2017): the Supreme Court held the right to privacy to be a fundamental right under Article 21 and Part III of the Constitution. It is the constitutional background to the Act.Wikipedia
Achievements
- The 2019 Bill was withdrawn, and the 2023 Bill was passed by Rajya Sabha in August 2023.Wikipedia
- The Consent Manager registration framework came into effect, with an online portal for applications. Consent Managers enable Data Principals to give, manage, review and withdraw consent through a platform.PIB
Challenges
- Phased commencement means that the core rights of Data Principals and the duties of Data Fiduciaries only apply from 13 May 2027, so the gap between enactment and full effect is long.PIB
- Small firms may find the net worth and capacity test for Consent Managers hard to meet, which could limit the number of registered providers.
Way forward
Timeline
14 November 2026
Consent Manager registration framework took effect; online portal dpbi.gov.in opened for eligible Indian companies to apply, with other key provisions scheduled for 13 May 2027.
Read the story13 November 2025
Provisions on establishment of the Data Protection Board of India brought into force.Wikipedia
11 August 2023
President gave assent, and the Bill became the Digital Personal Data Protection Act, 2023.Wikipedia
3 August 2023
Digital Personal Data Protection Bill, 2023 introduced in Lok Sabha.Wikipedia
18 November 2022
Digital Personal Data Protection Bill, 2022 released for public consultation.Wikipedia
3 August 2022
Personal Data Protection Bill, 2019 withdrawn from Parliament.Wikipedia
11 December 2019
Personal Data Protection Bill, 2019 tabled in Lok Sabha and referred to a Joint Parliamentary Committee.Wikipedia
22 December 2018
A committee of experts was constituted to deliberate on a data protection framework for India.Wikipedia
24 August 2017
Supreme Court's Right to Privacy verdict in Justice K. S. Puttaswamy vs Union of India, holding privacy a fundamental right under Article 21.Wikipedia
Every new story on this subject is added here automatically.
Frequently asked questions
Who runs the DPDP framework?
Q: Who launched the Consent Manager registration portal? A: The Secretary of the Ministry of Electronics and Information Technology.PIB
What is the minimum net worth for a Consent Manager?
A company incorporated in India must have a net worth of not less than ₹2 crore, together with adequate technical, operational and financial capacity.PIB
When do the Data Principal rights come into force?
The provisions on Data Principal rights, Data Fiduciary obligations and the Board's inquiry and penalty processes are scheduled for 13 May 2027.PIB
GS paper mapping
- GS-2Governance: Government policies and interventions for development in various sectors; statutory, regulatory and quasi-judicial bodies
- GS-2Polity and Constitution: Fundamental rights (Article 21, right to privacy)
- GS-3Science and Technology: Developments in information technology, cyber security and data protection
Sources
Every fact on this page was checked against these pages.
