India’s Digital Personal Data Protection Act 2023 receives Presidential assent today, establishing the country’s first comprehensive personal data protection law.
Key points
- Applies to digital personal data processed in India and processing outside India for offering goods or services to people in India.
- Consent and notice requirements, with limited legitimate uses.
- Reasonable security safeguards and breach notification are required.
- A Data Protection Board can impose penalties up to ₹250 crore per breach.
- Obligations take effect once implementing rules are notified.
UK organisations with Indian customers, or using Indian outsourcing providers, should begin planning for DPDP compliance.
Source: Digital Personal Data Protection Act 2023 (MeitY, Government of India)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
