Digital Personal Data Protection Act 2023 and DPDP Rules 2025

What it is

The Digital Personal Data Protection Act 2023 (DPDP Act) is India’s general data protection law. Parliament enacted it on 11 August 2023. The Digital Personal Data Protection Rules 2025, published by MeitY in the Gazette as G.S.R. 846(E) on 13 November 2025, give the Act full effect and set out the detail of notices, consent managers, breach intimation, data principal rights and the Data Protection Board of India.

The Act is not an AI law, but it is the main binding rulebook for AI in India wherever personal data is involved. MeitY’s India AI Governance Guidelines lean on it directly as a source of accountability for AI systems that handle personal data.

Who it applies to

The Act applies to the processing of digital personal data within India, whether collected in digital form or digitised later. It also applies to processing outside India where that processing is connected to offering goods or services to data principals in India. That brings in foreign providers of AI products and services used by people in India.

The Act uses its own vocabulary. A Data Fiduciary decides the purpose and means of processing. A Data Processor processes on its behalf under a valid contract. A Data Principal is the individual the data relates to, including a parent or lawful guardian for a child. The Central Government can notify any data fiduciary or class of fiduciaries as a Significant Data Fiduciary based on the volume and sensitivity of data, risk to data principals, and potential impact on sovereignty, electoral democracy, state security and public order.

Personal data processed for personal or domestic purposes, and some publicly available data, fall outside the Act. Section 17 sets out further exemptions.

What it requires

For AI systems, the obligations that matter most are these.

• Lawful basis and notice. Processing needs consent or a listed legitimate use. Each data fiduciary must give a clear, standalone notice explaining the specific purpose of collection and use.
• Accuracy for decisions. Under section 8(3), where personal data is likely to be used to make a decision that affects the data principal, or disclosed to another data fiduciary, the fiduciary must ensure its completeness, accuracy and consistency. This is the closest the Act comes to a rule on automated decisions.
• Accountability for processors. The data fiduciary remains responsible for processing done on its behalf by a processor, which covers AI vendors processing personal data for a customer.
• Security and breach intimation. Reasonable security safeguards are required. On becoming aware of a breach, the fiduciary must tell affected individuals without delay and inform the Board, with a detailed report within 72 hours.
• Data principal rights. Individuals can access, correct, update and erase their data and nominate someone to act for them. Fiduciaries must respond within 90 days.
• Children’s data. Verifiable consent from a parent or guardian is required, with exceptions set out in the Rules.

Significant Data Fiduciaries carry additional duties under section 10 and Rule 13. They must appoint a Data Protection Officer based in India who reports to the board, appoint an independent data auditor, and run a Data Protection Impact Assessment and an audit once every twelve months, with a report of significant observations given to the Board. Rule 13(3) adds a duty of due diligence to verify that technical measures, including algorithmic software used to process personal data, are not likely to pose a risk to data principals’ rights. Some personal data specified by the government on a committee’s recommendation may also have to stay in India.

Key dates

The Rules commence in three phases, all counted from publication on 13 November 2025.

• 13 November 2025. Rules 1, 2 and 17 to 21 in force, which establish the Data Protection Board of India.
• 13 November 2026. Rule 4 in force, covering the registration and obligations of Consent Managers.
• 13 May 2027. Rules 3, 5 to 16, 22 and 23 in force. This brings in notice, security safeguards, breach intimation, retention, children’s data, Significant Data Fiduciary duties and data principal rights.

These are the dates in the Rules as published. Check the Gazette and MeitY for any later amendment to the timetable.

How it relates to other frameworks

The DPDP Act is narrower than the EU GDPR on automated decisions. It has no standalone right not to be subject to a solely automated decision, and relies instead on notice, accuracy duties and data principal rights. The Significant Data Fiduciary regime is where AI-specific scrutiny sits, through the DPIA, the audit and the algorithmic due diligence duty.

An AI impact assessment built for ISO/IEC 42001 or the EU AI Act covers much of what a DPDP DPIA needs, provided it addresses the rights of data principals, the purpose of processing and the management of risk to those rights. In the financial sector, the Reserve Bank of India’s FREE-AI framework adds sector expectations on top of the Act.

A note on this page

This is Aicura’s reading of the Act and Rules, written to help you understand them. It is not legal advice and it is not the law itself. Read the Act and Rules as published by MeitY and in the Gazette of India, and take advice on how they apply to your organisation.