DPDP Act 2023 & Rules 2025
Study the core terms, consent framework, Data Principal rights, penalties and phased commencement. Then test your understanding with 30 exam-oriented questions.
This study guide is a concise learning aid, not legal advice. Commencement is phased; distinguish the Act's notification from the date each provision becomes operative. Two items in the supplied question bank need editorial verification before public release; see the review note at the end.
Know the roles
- Data Principal
- The individual to whom the personal data relates. The Act's definition also addresses a child and a person with disability through the relevant parent or lawful guardian.
- Data Fiduciary
- The person who alone or together with others determines the purpose and means of processing personal data. A bank making these decisions may act as a Data Fiduciary.
- Data Processor
- A person who processes personal data on behalf of a Data Fiduciary. The actual arrangement and activity matter more than the vendor's label.
- Consent Manager
- A person registered with the Board that acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
- Child
- An individual who has not completed 18 years of age, as defined by the Act.
Scope, lawful processing and consent
- The Act applies to digital personal data processed within India when collected digitally or collected non-digitally and digitised subsequently, subject to the Act.
- It can also apply to processing outside India when connected with offering goods or services to Data Principals within India.
- Processing must be for a lawful purpose and based on consent or a recognised “certain legitimate use”, as applicable.
- Consent must be free, specific, informed, unconditional and unambiguous, indicated through clear affirmative action, and limited to personal data necessary for the specified purpose.
- Consent can be withdrawn. The withdrawal process should be comparable in ease to the process of giving consent; withdrawal does not automatically erase separate legal retention duties.
- When considering an erasure request, distinguish the individual's rights from applicable legal or regulatory retention requirements.
Rights and organisational responsibilities
- Data Principal rights include access to information about personal data, correction and completion, erasure subject to applicable provisions, grievance redressal, and nomination.
- Data Fiduciaries have duties under the Act, including taking reasonable security safeguards and notifying personal data breaches as required by the applicable provisions.
- Do not assume every bank activity, every financial-data operation, or every regulated organisation is automatically exempt. Exemptions depend on the provision and its conditions.
- A Data Processor processes on behalf of a Data Fiduciary; classify the relationship based on the actual processing arrangement.
Data Protection Board and penalty framework
- The Data Protection Board of India is established under Section 18. Section 27 addresses the Board's powers and functions.
- The inquiry process includes an opportunity of being heard in accordance with the Act.
- The Schedule sets maximum penalty amounts for specified contraventions. A maximum is not an automatic fixed penalty in every case.
- The Schedule includes maxima of ₹250 crore for failure to take reasonable security safeguards, ₹200 crore for failure to notify the Board and affected Data Principals of a breach, ₹150 crore for specified Significant Data Fiduciary obligations, and ₹50 crore for a contravention for which no separate penalty is specified.
- Section 33(2) lists factors used when determining a monetary penalty, including the nature, gravity and duration of the breach; type and nature of data affected; repetition; gain or loss avoided; mitigation; proportionality and deterrence; and the likely impact of the penalty on the person.
- Section 34 says penalty sums realised by the Board are credited to the Consolidated Fund of India.
Fast revision table
| Provision | Exam cue |
|---|---|
| Section 3 | Application and scope of the Act |
| Sections 5–6 | Notice and consent |
| Section 8(6) | Intimation of personal data breach |
| Section 10 | Additional obligations of Significant Data Fiduciaries |
| Section 18 | Establishment of the Data Protection Board of India |
| Section 27 | Powers and functions of the Board |
| Section 28 | Inquiry procedure |
| Section 29 | Appeal to the Appellate Tribunal |
| Section 30 | Orders passed by Appellate Tribunal to be executable as decree |
| Section 31 | Alternate dispute resolution |
| Section 32 | Voluntary undertaking |
| Section 33 | Penalties |
| Section 34 | Crediting penalty sums to Consolidated Fund of India |
Section names and numbering above follow the official Act text. Review the latest notifications and any later changes before the exam.
Do not mix up notification and commencement
The DPDP Act, 2023 received Presidential assent.
The Act's commencement notification specified different phases: some provisions immediately, Section 6(9) and Section 27(1)(d) one year later, and another group eighteen months later.
The DPDP Rules, 2025 were notified. Rules 1, 2 and 17–21 commenced on publication; Rule 4 is scheduled one year later; Rules 3, 5–16 and 22–23 are scheduled eighteen months later.
The Act and Rules have different notification dates. Calculate their phased commencement dates separately and confirm the latest official notifications.
Read the primary sources
Test all three sets
30 questions · 30 marks · explanations · exam traps · set-wise results
Editorial verification before publication
Question 18: The supplied question describes Section 33(2) as considering the “likely impact of the contravention on the affected person.” The official Act's Section 33(2)(g) instead refers to the likely impact of imposing the monetary penalty on the person. The supplied answer key is preserved, but this question's wording/answer rationale needs correction approval before the quiz is treated as legally verified.
Question 30: The supplied question refers to a Removal of Difficulties Order dated 5 October 2026. I could not locate an official government copy in this verification pass. The wording and supplied answer key are preserved, but the order and its effect must be checked against an official Gazette/MeitY source before publication.
These are editorial flags, not a claim that the entire quiz has been legally certified.