What is the DPDP Act 2023?
India's personal data protection law, in plain terms — and what it obliges an organisation to actually do.
Knowledge hub
What is the DPDP Act 2023?
The Digital Personal Data Protection Act 2023 is India's law governing how organisations process digital personal data. It requires consent or another lawful basis, limits use to the stated purpose, obliges organisations to keep data secure, grants individuals rights over their data, and requires notification of breaches.
What it obliges you to do
- Obtain clear consent, in plain language, stating the purpose — or rely on another lawful basis.
- Use the data only for that stated purpose.
- Keep it only as long as the purpose requires, then delete it.
- Secure it with reasonable safeguards.
- Honour requests for access, correction and erasure.
- Publish a grievance mechanism and respond to complaints.
- Notify the Data Protection Board and affected individuals of a breach.
Where it bites in practice
Enquiry forms and chatbots collecting contact details, analytics that identify individuals, CRM records held indefinitely, and personal data written to systems that cannot delete it. The last is why we keep personal data off blockchains — an immutable ledger cannot honour a right to erasure.
Retention is the obligation organisations most often overlook. Holding every lead forever is not compatible with purpose limitation.
This is not legal advice
This entry is a plain-language summary written to help you ask better questions. Rules and enforcement continue to develop, and your obligations depend on your circumstances. Consult your legal advisers and the primary sources for binding positions.
Talk it through before you commit
A discovery call is a working session on your constraint, not a sales pitch.
Related
Where this connects
Quick inquiry
Tell us what you're trying to build
A short note is enough. You'll hear back from the team, not a bot — usually within one working day.
- +91 83695 17339
- Palava City, Dombivli, Thane, MH 421204