The Definitive Statutory Guide to DPDP Act 2023

Data Fiduciary

Data Principal

Consent Manager

The entity determining the purpose and means of processing personal data, bearing primary responsibility under the Act.

The individual to whom the personal data relates, whose rights are protected and consent is paramount.

An entity enabling Data Principals to manage, review, and withdraw their consent for data processing.

Government Exemptions and State Security Provisions

Understand the specific circumstances under which the Act's provisions may be relaxed for national security, public order, and research purposes, as outlined in Section 17.

Statutory Penalties Under DPDP Act

Breach of Data Principal Obligations

Non-Compliance with Children's Data

Failure to Notify Data Breach

Failure to protect personal data can incur penalties up to ₹250 crore, emphasizing robust security measures.

Processing children's data without verifiable consent or in a manner detrimental to their well-being can lead to significant fines.

Delay or omission in reporting data breaches to the Data Protection Board and affected Data Principals carries substantial penalties.

Download the complete DPDP Act 2023 with expert annotations and operational insights, formatted for legal clarity.