WARRANTThe statute, in its own words.
The Digital Personal Data Protection Act, 2023 was enacted by Parliament as Act 22 of 2023 and received the assent of the President on 11 August 2023. The short title and territorial scope sit at Section 1. The operative definitions sit at Section 2. The two together describe what the Act calls itself, where it reaches, and on what it acts.
The four definitional terms the rest of the Act turns on are all in Section 2. Each is short. Each is loaded.
The Act has nine chapters. Chapter I, preliminary, runs Sections 1 and 2. Chapter II, obligations of Data Fiduciary, runs Sections 4 to 10. Chapter III, rights and duties of Data Principal, runs Sections 11 to 15. Chapter IV, special provisions, runs Sections 16 and 17. Chapter V, the Data Protection Board of India, runs Sections 18 to 26. Chapters VI to IX cover appellate procedure, penalties, miscellaneous, and the Schedule.
The consent regime, verbatim.
Sections 4 to 7 set the lawful-basis architecture. Section 4 is the gating clause. Section 5 attaches notice. Section 6 attaches the qualifications on consent. Section 7 enumerates the legitimate uses that operate without consent.
Section 5 governs notice. Every request for consent must be accompanied or preceded by a notice giving the Data Principal the personal data and purpose, the manner in which the Data Principal may exercise her rights under Sections 11 to 13, and the manner in which the Data Principal may make a complaint to the Board. The notice must be available in English and in any of the twenty-two languages specified in the Eighth Schedule to the Constitution.
Section 6 is the load-bearing definition of consent and its qualifications.
Section 6(4) gives the Data Principal the right to withdraw her consent at any time, and the consequences of withdrawal must follow. Section 6(5) requires that the ease of withdrawal be comparable to the ease of giving consent. Section 6(7) introduces the Consent Manager: an entity registered with the Board through which a Data Principal may give, manage, review, or withdraw her consent. The Consent Manager is not a Data Fiduciary in respect of the consent it manages. It is a fiduciary to the Data Principal.
Section 7 enumerates the legitimate-uses pathway. The pathway is exhaustive, not illustrative. The named uses include voluntary specified-purpose disclosure, performance of any function under any law, response to medical emergency, services in the event of disaster or breakdown of public order, and processing in employment-related contexts. Outside Section 7 and outside Section 6 consent, processing is unlawful.
Section 8, walked through.
Section 8 is the operating spine of the Act for every business that processes personal data in India. Eleven sub-sections. Each one names a deliverable. Each one attaches Schedule penalty exposure once the Schedule comes into force on 13 May 2027. I will quote each in full and mark the implication for an AI agent or automated decision system.
Sub-section (1) does two things at once. It puts accountability on the Data Fiduciary irrespective of contract. It puts accountability on the Data Fiduciary for processing performed by its Data Processor. The processor is not a shield. The contractual chain is read past, not read around.
Sub-section (3) is the accuracy clause. It is narrower than the headline "completeness, accuracy, and consistency" reading sometimes given. The trigger is not all processing. The trigger is processing likely to feed a decision that affects the Data Principal, or disclosure to another Data Fiduciary.
Sub-section (4) is the technical-and-organisational-measures clause. It is the closest analogue in DPDP to GDPR Article 32(1).
Sub-section (5) is the security-safeguards clause. The Schedule attaches a ceiling of Rs 250 crore to its breach. It is the highest fine ceiling in the Act.
Sub-section (6) is the breach-intimation clause. The Act delegates the form and manner. The Rules supply it. The clock that compliance teams are now planning around is in Rule 7 of the DPDP Rules 2025, not in Section 8(6) itself.
Sub-section (7) is the erasure clause. It runs against a default of erasure on consent withdrawal or on the specified purpose ceasing to be served, with a carve-out for retention required by law. Sub-section (8) defines when the specified purpose is "deemed no longer to be served." Sub-section (11) supplies the test of non-engagement.
Sub-sections (9) and (10) are the surface-area clauses. They name the contact and the redress mechanism the Data Fiduciary owes the Data Principal in real time, not on request.
Sub-section (11) is technical. It clarifies the test for whether the Data Principal has approached the Data Fiduciary for the performance of the specified purpose. The Act treats non-initiation, in person or by communication, as non-engagement. Combined with Section 8(7) and Section 8(8), this is an automatic erasure trigger after the prescribed period of dormancy.
The rights of the Data Principal.
Chapter III of the Act runs Sections 11 to 15. The first four sections are rights. The fifth is duties. The architecture is intentional. The Data Principal carries duties as well as rights, and Section 33 read against Section 15 makes false or frivolous grievance a fineable matter.
Section 12 grants the right to correction, completion, updating, and erasure. The Data Fiduciary must correct inaccurate or misleading personal data, complete incomplete data, update data on request, and erase personal data on request unless retention is required for the specified purpose or by law.
Section 13 grants the right to grievance redressal. The Data Principal may approach the Data Fiduciary or Consent Manager. Internal remedy must be exhausted before approach to the Board. Section 13(3) requires response within such period as may be prescribed; Rule 13(3) of the DPDP Rules 2025 fills this in.
Section 14 grants the right to nominate. The Data Principal may, in such manner as may be prescribed, nominate any other individual who shall, in the event of death or incapacity, exercise the rights of the Data Principal. Incapacity, in this context, means inability to exercise the rights due to unsoundness of mind or infirmity of body.
Section 15 is the duties clause. The Data Principal must comply with applicable laws while exercising rights, must not impersonate, must not suppress material information when providing data for any document of identity issued by the State, must not register a false or frivolous grievance, and must furnish only verifiably authentic information when exercising rights of correction or erasure. The Schedule attaches a Rs 10,000 cap on penalty for breach of Section 15.
The breach clock, read carefully.
Earlier compliance commentary, including some prior Warrant content, has compressed Section 8(6) into a single "72-hour" claim. The text does not say 72 hours. It says intimation in such form and manner as may be prescribed. The 72-hour clock lives in Rule 7 of the DPDP Rules 2025, where MeitY has now prescribed the form and manner.
Rule 7(1) requires the Data Fiduciary to give intimation of a personal data breach to each affected Data Principal without delay, and in concise, clear, and plain language. Rule 7(2) requires the Data Fiduciary to give intimation to the Board, in two stages. First stage: without delay, with the description of the nature, extent, timing, and location of the breach and its likely impact. Second stage: within 72 hours of becoming aware of the breach, or such longer period as the Board may, on a request made in writing, allow, with the broad facts and the cause, mitigation taken, identification of persons responsible, and a summary of intimations given to affected Data Principals.
The Rule does not introduce a materiality threshold. Any unauthorised acquisition, access, use, disclosure, alteration, or loss of personal data is a personal data breach for the purposes of the obligation. The defensive posture is now: detect, notify both populations within the prescribed window, document the cause and the corrective action, and preserve the chain back to the source event.
Where the Act reaches.
The extra-territorial application of the DPDP Act is in Section 1, not Section 16. Earlier Warrant content cited Section 16 as the extra-territorial section. That is a regression. Section 16 governs the onward transfer of personal data outside India, which is a different question. The reach of the Act onto a foreign-established data fiduciary is the Section 1(2)(b) clause.
The hook is "in connection with any activity related to offering of goods or services to Data Principals within the territory of India." The construction is broad. A US-incorporated lender taking applications from Indian residents is in. A Singapore-incorporated SaaS vendor processing employee data of an Indian customer's workforce is in. Establishment in India is not the predicate. Targeting of Data Principals in India is.
Section 16, by contrast, governs transfer. Sub-section (1) permits transfer of personal data by a Data Fiduciary outside India, subject to such restrictions as the Central Government may, by notification, impose in respect of any country or territory outside India. Sub-section (2) clarifies that nothing in Section 16 restricts the applicability of any law for the time being in force in India that provides for a higher degree of protection on transfer. The architecture is permissive-with-blacklist, not whitelist-with-adequacy as under GDPR Articles 44 to 49. Sibling privacy reading across regimes: GDPR Article 22, China PIPL, and HIPAA read against AI agents.
The Data Protection Board of India, per Sections 18 to 26.
The Data Protection Board of India is the regulator. The earlier Warrant content cited Chapter VIII and Section 27 onwards for the Board. That is a regression. The Board is established under Section 18 in Chapter V of the Act. Chapter VIII is Penalties and Adjudication, where Section 33 sits. The two are different chapters and answer different questions.
Section 19 governs composition. The Board is to consist of a Chairperson and such number of other Members as the Central Government may notify. Members must be persons of ability, integrity, and standing with special knowledge or practical experience in data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, or in any other field which in the opinion of the Central Government may be useful. At least one member must be an expert in the field of law.
Section 20 sets the term at two years with eligibility for re-appointment. Section 21 lists disqualifications. Section 27 sets out the powers and functions of the Board, the most operative being directing remedial or mitigation measures in the event of a personal data breach, inquiring into a breach of the provisions of the Act, and imposing penalties as provided under the Act.
The operational status of the Board, as at 9 May 2026, is the half-step. By the MeitY notification of 13 November 2025, Sections 1, 2, and 18 to 26 of the Act, and Rules 1, 2, and 17 to 21 of the DPDP Rules 2025 came into force. The Board has legal existence. It has the power to set its procedure under Section 23. Public reporting through April 2026 indicates the Chairperson and full slate of Members had not yet all been appointed. The search-cum-selection committee process under the Rules has been initiated. The Board's substantive enforcement clock is running quietly. It does not yet bite. It bites on 13 May 2027, when the Schedule penalties attach.
What the Rules added.
The DPDP Rules 2025 were notified by the Ministry of Electronics and Information Technology by Gazette notification on 13 November 2025. They run twenty-three rules in seven schedules. The Rules are not new obligations. They are the prescribed form and manner for the obligations the Act delegates. Each "as may be prescribed" in the Act points to a Rule.
The Schedule to the Rules sets a phased commencement. Three groups.
The most operationally consequential rules to know now, in advance of 13 May 2027:
Rule 3. Form and content of notice under Section 5. The notice must be in clear and plain language, accessible independently of any other information, and itemised against the personal data, the specified purpose, the goods or services involved, the description of rights of the Data Principal, and the manner of complaint to the Board.
Rule 7. Form and manner of intimation of personal data breach. First intimation without delay. Detailed report to the Board within 72 hours of awareness, or such longer period as the Board may allow on a written request. Intimation to each affected Data Principal without delay, in concise, clear, and plain language, and in any of the languages specified in the Eighth Schedule to the Constitution.
Rule 8. Time period for retention by certain Data Fiduciaries and the deemed-erasure trigger. For Data Fiduciaries falling within the prescribed classes (operationally, large e-commerce, social media intermediaries, and online gaming intermediaries above prescribed user thresholds), the deemed-erasure window under Section 8(8) is three years from the last engagement, after which Section 8(7) erasure applies.
Rule 12. Additional obligations of Significant Data Fiduciaries. Annual Data Protection Impact Assessment, annual audit by an independent data auditor, observation of due diligence by the Significant Data Fiduciary in respect of any algorithmic software it deploys, and verification that personal data flowing into algorithmic decisioning is not used in a manner that poses a risk to rights of Data Principals.
Rule 15. Restrictions on transfer of personal data outside India. The Data Fiduciary must meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of, or any agency of, such a foreign State. The Rule does not enumerate countries; the architecture is permissive-with-future-blacklist.
Where Warrant maps DPDP.
DPDP, RBI FREE-AI, and the sectoral overlay.
The DPDP Act applies to every Data Fiduciary processing digital personal data in India, full stop. The sectoral regulators do not displace it. They stack on top. A regulated bank deploying an AI agent in retail credit operates under at least three concurrent obligation layers.
The first layer is the DPDP Act and Rules. Section 8 obligations on accuracy, security, breach, and erasure attach. Section 16 transfer restrictions attach. The Board is the supervisor for the personal-data dimension.
The second layer is the Reserve Bank of India guidance. The RBI Framework for Responsible and Ethical Enablement of AI (FREE-AI) report, released by the FREE-AI Committee in 2025, sets out seven sutras and twenty-six recommendations across six strategic pillars covering infrastructure, capacity, governance, protection, assurance, and policy. The recommendations land on regulated entities through subsequent RBI Master Directions and circulars. The FREE-AI overlay does not weaken Section 8; it strengthens it for regulated entities and adds explainability, model risk management, and human override duties beyond the DPDP floor.
The third layer is sector-specific. SEBI's retail algo framework and AI/ML disclosure norms attach to brokers and asset managers. IRDAI's information and cyber security guidelines and outsourcing directions attach to insurers. CERT-In's six-hour incident notification rule of 28 April 2022, made under Section 70B(6) of the Information Technology Act 2000, runs alongside the DPDP 72-hour clock for cyber-security incidents. Six hours to CERT-In. Without delay then 72 hours to the Board. Both apply. Both must be evidenced.
What Section 8 means for an AI agent.
Read Section 8(3) at the speed of an automated decision system. The clause attaches when personal data is "likely to be used to make a decision that affects the Data Principal." For a credit-scoring agent, an underwriting agent, a fraud-screening agent, or a hiring-shortlist agent, that condition is satisfied on every run. The accuracy obligation, "completeness, accuracy and consistency," is then the obligation. Three elements. Each separately enforceable.
Completeness reads as: did the agent see the personal data the specified purpose required. A credit-decision agent that decided on a partial bureau pull, where the full bureau pull would have changed the outcome, may fail this leg even if the partial data the agent saw was internally accurate. The Section 33(2) sizing factors include the gravity of the breach. A wrong credit decline made on incomplete data is graver than one made on bad-format data.
Accuracy reads as: was the personal data the agent saw faithful to the source. This is the field where input-validation and source-provenance attestation pay back. A lineage from bureau API to model input, independently verifiable without contacting Warrant, is the answer.
Consistency reads as: did the agent's view of the personal data agree with the same data held by the same Data Fiduciary in adjacent systems. A Data Fiduciary maintaining one address in CRM and another in the credit decisioning system, on the same Data Principal, with no reconciliation, fails the consistency leg even if both are individually accurate.
Section 8(4) reads, for an AI agent, into the technical and organisational measures around the agent itself. The Significant Data Fiduciary regime in Section 10, read with Rule 12, attaches additional duty of due diligence on algorithmic software. The combination is: maintain evidence, on every decision, that the input was complete, accurate, and consistent at the time of decision, and that the model was within its approved purpose.
This is what an attestation layer does. One artefact per decision, a record mapped to the relevant Section 8 sub-section and retrievable by Data Principal identifier, independently verifiable without contacting Warrant. The DPDP Act does not require this artefact by name. The Schedule penalty exposure for failure to evidence the obligation makes its absence expensive on 13 May 2027.
Questions a compliance officer asks first.
Read the source directly.
- The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) · MeitY official PDF
- Digital Personal Data Protection Rules, 2025 · MeitY official notification
- PIB · DPDP Rules 2025 notified · 13 November 2025
- PIB · DPDP Rules 2025 official summary
- PRS India · DPDP Bill, 2023 legislative tracker
- Per-obligation Warrant evidence field mapping for India
Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. Verbatim quotations of Sections 1, 2, 4, 6, 8, 11, 16, and 18 of the Digital Personal Data Protection Act, 2023 reflect the official English-language text published by the Ministry of Electronics and Information Technology, Government of India. References to the DPDP Rules, 2025 reflect the Gazette notification of 13 November 2025 and the phased commencement Schedule attached to the Rules. Operational status of the Data Protection Board of India is stated as of 9 May 2026; subsequent appointments may have changed the position.