FAQS
The Digital Personal Data Protection Act, 2023 is India's first comprehensive law governing digital personal data. It applies to any organisation that processes the digital personal data of individuals in India
The Act comes into force in three phases. Full compliance is required by 13 May 2027, with no grace period after that date.
Penalties go up to Rs 250 crore for failing to put reasonable security safeguards in place, and up to Rs 200 crore for failing to report a breach or for breaking the rules on children's data.
Consent must be free, specific, informed, unconditional and unambiguous, and withdrawing it must be as easy as giving it. Individuals can also give, manage and withdraw consent through a registered Consent Manager.