Data Strategy Briefing — India Digital Personal Data Protection Act Assent

India's Digital Personal Data Protection Act (DPDP Act) received presidential assent on 11 August 2023. The law introduces a consent-centric framework, defines obligations for data fiduciaries and significant data fiduciaries, and empowers the Data Protection Board to levy penalties for noncompliance. It also sets conditions for cross-border transfers, with government notifications defining approved jurisdictions.

What changed

• Data fiduciaries must secure consent (or rely on limited legitimate uses) for processing and provide withdrawal, access, and correction rights to data principals.
• Significant data fiduciaries face additional duties: DPIAs, independent audits, appointing a Data Protection Officer based in India, and grievance redressal mechanisms.
• Cross-border transfers are allowed unless restricted by government notification; penalties can reach billions of rupees for violations.

Why it matters

• Enterprises handling Indian personal data must implement consent management, notice updates, and withdrawal handling aligned with the DPDP Act.
• Vendors and cloud providers need to evaluate whether they qualify as significant data fiduciaries and prepare for audits, DPIAs, and local representation.
• Cross-border data strategies must track forthcoming whitelists/blacklists to determine whether data localization or regional processing is required.

Action checklist

• Inventory Indian personal data flows, update privacy notices, and deploy consent/withdrawal workflows that log signals for auditability.
• Assess whether you meet significant data fiduciary thresholds and prepare DPIA templates, board reporting, and DPO appointment plans.
• Monitor government notifications on permitted destinations and refresh contracts and technical controls for transfers accordingly.

Related briefings

Curated signals from the same pillar or overlapping topics.

Data Strategy · Credibility 40/100 · October 22, 2021

Data Strategy Briefing — G7 Digital Trade Principles

G7 Trade Ministers adopted the Digital Trade Principles on 22 October 2021, setting commitments on open digital markets, cross-border data flows with trust, and safeguards on personal data and cybersecurity that shape…

Data Strategy · Credibility 40/100 · January 1, 2023

Data Strategy Briefing — California Privacy Rights Act Effective Date

The California Privacy Rights Act took effect on 1 January 2023, expanding consumer rights, creating the California Privacy Protection Agency, and tightening data minimization rules that organizations must embed into…

Data Strategy · Credibility 86/100 · October 1, 2022

Data Strategy Briefing — Japan APPI Cross-Border Transfer Rules Enforced

Japan enforced the amended Act on the Protection of Personal Information on 1 October 2022, requiring fuller disclosure and monitoring for cross-border transfers plus mandatory breach notification to the PPC.

Data Strategy · Credibility 40/100 · September 1, 2022

Data Strategy Briefing — China Cross-Border Data Security Assessments Effective

China's Cyberspace Administration began enforcing mandatory security assessments for certain cross-border data transfers on 1 September 2022, requiring exporters to file assessments or adopt standard contracts before…

Data Strategy · Credibility 40/100 · August 3, 2022

Data Strategy Briefing — India Withdraws Personal Data Protection Bill

India withdrew its long-debated Personal Data Protection Bill on 3 August 2022, resetting the legislative process and signaling that a broader Digital Personal Data Protection Bill would follow, affecting localization…

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Interoperability Engineering Guide — Zeph Tech

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide — Zeph Tech

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

• Data Strategy Operating Model Guide — Zeph Tech

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…