The Digital Personal Data Protection Act, 2023: Rights and Duties

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) gives every individual whose digital personal data is processed, called the Data Principal, four core rights: to get information about that data, to correct and erase it, to have grievances redressed, and to nominate someone to act after death or incapacity (sections 11 to 14). In return, section 15 places five duties on the individual, such as not impersonating anyone and not filing false complaints. The companies and government bodies that handle the data, called Data Fiduciaries, carry the heavier obligations and face penalties of up to Rs 250 crore.

This explainer is written for B.A. LL.B. and LL.B. students preparing for Cyber Law or Constitutional Law papers, and for anyone in Kanyakumari District who has ever wondered what an app or a bank may do with their phone number and Aadhaar details. The Act is new, its Rules are still coming into force in stages, and the Supreme Court is examining parts of it, so knowing the current position matters.

Where does the Act come from?

The starting point is Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, decided on 24 August 2017. A nine judge bench unanimously held that privacy is a fundamental right protected under Article 21 and Part III of the Constitution, and overruled M.P. Sharma and Kharak Singh on this point. The Court also laid down a three part test for any intrusion into privacy: there must be a law (legality), it must pursue a legitimate state aim (necessity), and the means must be proportionate to that aim.

The DPDP Act is Parliament's statutory framework for one part of that right, informational privacy. It received Presidential assent and was published in the Gazette on 11 August 2023. Section 1(2) left commencement to Central Government notification.

Which key terms should every student know?

• Data Principal (section 2(j)): the person to whom the data relates. For a child, this includes the parent or lawful guardian. For a person with disability, it includes the lawful guardian acting on their behalf.
• Child (section 2(f)): an individual who has not completed eighteen years.
• Data Fiduciary: the person who decides the purpose and means of processing, for example a bank, an e-commerce site or a college.
• Consent Manager (section 6(7) to (9)): a registered body through which you can give, review and withdraw consent.
• Board: the Data Protection Board of India set up under section 18.

The Act covers digital personal data, including data collected offline and later digitised. Processing is allowed only for a lawful purpose, either with consent (sections 4 to 6) or for certain legitimate uses listed in section 7, such as a medical emergency or employment.

What are your rights as a Data Principal?

1. Right to access information (section 11): on request, you can get a summary of the personal data being processed, the processing activities, and the identities of other Fiduciaries and Processors with whom it was shared.
2. Right to correction and erasure (section 12): you can ask for inaccurate or misleading data to be corrected, incomplete data completed and old data updated. On an erasure request, the Fiduciary must erase the data unless it is still needed for the specified purpose or a law requires retention.
3. Right of grievance redressal (section 13): the Fiduciary or Consent Manager must provide a readily available grievance mechanism. Under section 13(3) you must use that mechanism first before approaching the Board.
4. Right to nominate (section 14): you can nominate another individual to exercise your rights if you die or become incapable through unsoundness of mind or infirmity of body.

Add to these the right in section 6(4) to withdraw consent at any time, with the ease of withdrawal comparable to the ease of giving it. Take a student in Nagercoil who signed up for a coaching app and now wants out. She should be able to withdraw consent as simply as she clicked "I agree", and once consent is withdrawn the app must erase her data under section 8(7), unless a law requires it to be kept.

What are your duties under section 15?

This is the part most commentators skip and examiners like to ask. A Data Principal must:

1. comply with all applicable laws while exercising rights under the Act;
2. not impersonate another person while providing personal data for a specified purpose;
3. not suppress material information while providing personal data for any document, unique identifier, or proof of identity or address issued by the State;
4. not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board;
5. furnish only verifiably authentic information while exercising the right to correction or erasure.

Breach of these duties can attract a penalty of up to Rs 10,000 under the Schedule. So a tenant in Madurai who files a string of baseless complaints against a housing portal to pressure it is not using the Act, he is exposing himself to a penalty.

What must Data Fiduciaries do, and what are the penalties?

Section 8 requires Fiduciaries to keep data accurate, take reasonable security safeguards, inform the Board and each affected person of a personal data breach, and erase data once the purpose is served. Section 9 requires verifiable parental consent for a child's data and bars tracking, behavioural monitoring and targeted advertising directed at children. Significant Data Fiduciaries have extra duties under section 10.

The Schedule (read with section 33) sets maximum penalties:

• up to Rs 250 crore for failing to take reasonable security safeguards (section 8(5));
• up to Rs 200 crore for failing to notify a breach (section 8(6));
• up to Rs 200 crore for breaching the obligations on children (section 9);
• up to Rs 150 crore for breaching the additional obligations of a Significant Data Fiduciary (section 10);
• up to Rs 50 crore for any other breach of the Act or Rules;
• up to Rs 10,000 for breach of a Data Principal's duties (section 15).

These are civil penalties imposed by the Board, not criminal sentences. Any person aggrieved by a Board order may appeal to the Telecom Disputes Settlement and Appellate Tribunal within sixty days of receiving it (section 29), and section 39 bars civil courts from entertaining suits on matters within the Board's powers. Section 44(2) also omitted section 43A of the Information Technology Act, 2000, which earlier provided compensation for negligent handling of sensitive data.

What is the position in 2026?

The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) dated 13 November 2025. Under Rule 1, Rules 1, 2 and 17 to 21 (mainly on the Board) took effect on publication, Rule 4 on Consent Managers takes effect one year after publication, and Rules 3, 5 to 16, 22 and 23 (notice, security, breach intimation, erasure, children's data and grievance redressal) take effect eighteen months after publication. The Government's own explainer refers to an eighteen month period for phased compliance and says Fiduciaries must respond to access, correction, update and erasure requests within 90 days. Calculate exact dates from the Gazette notification rather than from news reports.

The Act is also under challenge. On 16 February 2026, a bench headed by Chief Justice Surya Kant issued notice to the Union Government on petitions challenging several provisions, including section 44(3), which replaces section 8(1)(j) of the RTI Act with a simple exemption for "information which relates to personal information". The Court refused an interim stay and referred the matter to a larger bench. Check the Supreme Court website for the current status before you write about it.

We could not find any Tamil Nadu specific rules under this Act. It is a central law, administered by the Ministry of Electronics and Information Technology.

How should you write about this in an exam?

• Open with Puttaswamy (2017) and the Article 21 basis, in two lines.
• Define Data Principal and Data Fiduciary with section numbers.
• List rights under sections 11 to 14 and duties under section 15 as separate headings. Examiners notice when duties are left out.
• Mention the grievance first rule in section 13(3), the Board, the TDSAT appeal and the Schedule penalties.
• Close with a critical note: the RTI amendment, the exemptions in section 17, and the pending Supreme Court challenge.

Citizens who need help with a data complaint can approach the college legal aid clinic for guidance on the first steps.

Sources

• Digital Personal Data Protection Act, 2023 (MeitY): official text of the Act as published in the Gazette.
• Digital Personal Data Protection Rules, 2025 (MeitY): Gazette notification G.S.R. 846(E) with the commencement schedule.
• PIB explainer on the DPDP Rules, 2025: Government summary of rights, duties and penalties.
• India Code entry for the DPDP Act: official listing with Act number and date.
• Supreme Court Observer on the right to privacy case: background to Puttaswamy (2017).
• LiveLaw report of 16 February 2026: Supreme Court notice and reference in the RTI challenge.