India's Digital Personal Data Protection Act 2023 addresses lawful processing of digital personal data. Notice, consent, data-principal rights and security link the use of customer information with accountability, including breach response and evidence for the Data Protection Board.
TL;DR:
- Creates digital-data processing, notice, consent, fiduciary-duty and individual-rights rules.
- The 2025 Gazette phased institutional provisions ahead of core processing obligations.
- Most substantive duties were still awaiting scheduled commencement in October 2026.
Summary
A law for digital personal data
The Digital Personal Data Protection Act 2023 concerns personal data in digital form, including data collected digitally and information later digitised within its scope. It uses the concepts of data principal and data fiduciary to distinguish the individual from the person determining processing purposes and means. Payment-user information can fall within that framework, while applicability, exemptions and other sector requirements need separate consideration.
Processing, rights and accountability
The Act’s substantive framework addresses notice, consent and specified other legitimate uses, together with duties concerning security, breach response and the rights of data principals. It also provides for additional responsibilities for significant data fiduciaries and specific treatment of children’s data. These subjects connect a provider’s use of customer information with accountability across its processing arrangements, rather than treating a privacy policy as the whole compliance task.
Commencement is deliberately phased
G.S.R.843(E), dated 13 November 2025, commences defined institutional and rulemaking provisions on Gazette publication, certain consent-manager provisions after one year, and most core processing, duty and rights provisions after eighteen months. At28 October 2026, those later stages should not be represented as completed. The specific provision and its appointed commencement date matter when distinguishing an enacted requirement from a duty already in force.
Final rules and the payment context
The final Digital Personal Data Protection Rules 2025 provide implementation detail with their own staged commencement. They must be distinguished from the earlier draft rules and explanatory note. A payment business needs to map customer data, purposes and processing relationships against the provisions as they become operative, alongside existing financial-sector and other legal duties. The phased commencement must be considered when determining which substantive duties are already legally operative.
Keywords
- DPDP Act
- India privacy
- digital data
- consent notices
- fiduciary duties
- individual rights
- 2025 Rules
- phased commencement
- institutional provisions
- lawful processing