Digital Personal Data Protection Act (DPDP Act)

The Act applies to digital personal data processed in India, and to processing outside India connected to offering goods or services to people in India. It calls the organisation deciding the purpose a data fiduciary and the individual a data principal. Processing generally rests on consent or on listed legitimate uses, with a notice in plain language. Fiduciaries must keep data accurate, secure it, report breaches to the regulator and the people affected, and erase data once its purpose ends. Individuals can access, correct and erase their data, and name a nominee. Larger entities notified as significant data fiduciaries face extra duties such as impact assessments and an appointed officer. A Data Protection Board adjudicates and can impose financial penalties. Detailed rules and phased commencement shape how it applies in practice. Any business serving Indian users must check its practices against this one statute.

An Indian e-commerce company reviews its sign-up flow after the Act. It rewrites its notice in plain language, offers it in regional languages, separates marketing consent from order processing, sets up a channel for erasure requests, and trains its support team to log and answer rights requests within the stated time.