This chapter was last reviewed and updated on 20 December 2024.

The Government of India published the Digital Personal Data Protection Act, 2023 (DPDP Act) on 11 August 2023, which will form the new data protection framework in India. The DPDP Act introduces several compliance requirements for the collection, processing, storage, and transfer of digital personal data. It applies exclusively to personal data in digital form (and to non-digital data that is subsequently digitized), excluding non-personal and non-digital data.

The implementation of the DPDP Act will become clearer once the government takes further actions, such as notifying the provisions of the DPDP Act and releasing subsequent legislation. Additionally, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Privacy Rules) have not been expressly repealed. In the interim, entities may consider reviewing their current data security practices to align their policies and procedures with the compliance requirements under the DPDP Act.