India's Digital Personal Data Protection Act, 2023 was assented to by the President on the 11th of August, 2023 as Act No. 22 of 2023 [L1-C1]. The Act and the operational DPDP Rules, 2025 (notified by MeitY on the 14th of November, 2025) together form India's first general-purpose data protection statute.
This lesson covers three questions. What problem was this law written to solve? Who pushed for it? Why did it take six years from the first draft to the notified Rules?
The constitutional starting point
The story does not start in 2023. It starts in 2017, when a nine-judge Bench of the Supreme Court of India ruled in Justice K. S. Puttaswamy (Retd.) v. Union of India that the right to privacy is a fundamental right under Article 21 of the Constitution. That ruling created an immediate question: if privacy is a fundamental right, what statute protects it?
India had partial answers already. Section 43A of the Information Technology Act, 2000 imposed civil liability on bodies corporate that mishandled "sensitive personal data" defined under the SPDI Rules, 2011. Sectoral rules from the Reserve Bank of India, the Securities and Exchange Board of India, and the Insurance Regulatory and Development Authority of India each covered slices of the problem. None of them were comprehensive. None of them gave individuals direct rights against the entities holding their data.
The Srikrishna Committee
The Central Government constituted a committee of experts under the chairmanship of Justice B. N. Srikrishna in July 2017. The committee submitted its report in July 2018 with a draft Personal Data Protection Bill attached. The draft borrowed heavily from the European Union's General Data Protection Regulation (GDPR) but adapted concepts for the Indian context.
That draft went through three more iterations: the Personal Data Protection Bill, 2019; the Data Protection Bill, 2021 (which was withdrawn from Parliament in August 2022); and finally, the Digital Personal Data Protection Bill, 2023, which became the Act. Each iteration trimmed the text. The 2018 draft ran to over a hundred pages. The 2023 Act runs to under forty.
What the Act does, in one sentence
The DPDP Act provides for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes [L1-C2].
Three things are worth noting in that single sentence. First, the Act is about digital personal data. Paper-only records collected and stored in non-digital form are out of scope. Second, the Act balances two things: individual rights and lawful processing. It is not a maximalist privacy statute. Third, the word "processing" is doing heavy lifting and is defined later in the Act.
Why "digital personal data"?
Section 3 of the Act sets the scope. The Act applies to processing of digital personal data within the territory of India where the data is collected in digital form, or in non-digital form and digitised subsequently. It also applies to processing outside India if such processing is connected to offering goods or services to Data Principals within India [L1-C3].
This means three things in practice:
- A purely paper-based filing cabinet of customer records, never digitised, is outside the Act.
- The same filing cabinet, scanned to PDF, falls within the Act.
- A foreign SaaS company offering services to Indian users is bound by the Act, even if its servers sit in another country.
What this means for you
If you are a compliance professional, a founder, an engineer, or an in-house counsel reading this course, the practical takeaway from Lesson 1 is this: the DPDP Act is now operational law in India. The Rules notification on the 14th of November, 2025 set a phased enforcement timeline. Some provisions came into force immediately on notification. Others come into force at the 12-month mark, and a final set at the 18-month mark [L1-C4].
In the lessons that follow, we will cover what each provision actually requires, how to read the definitions, who is bound, and how to begin operationalising the Act in your organisation.