India Digital Personal Data Protection Act, 2023
India's consent-based personal data law, and the main legal constraint on AI training and deployment there. Significant data fiduciaries face added duties including algorithmic due diligence.
Key dates
- Aug 11, 2023Received presidential assent
- Nov 14, 2025DPDP Rules notified, with phased commencement
Risk areas addressed
Who it applies to
Data fiduciaries processing digital personal data in India, including those offering goods or services to Indian residents from abroad.
Penalties & enforcement
Up to ₹250 crore per instance of specified breaches.
Enforced by: Data Protection Board of India
India DPDP Act is enforced by Data Protection Board of India. Its obligations are already live, so a gap is a present exposure rather than a future one. In practice that means knowing which of your AI systems fall in scope across every sector you operate in, holding assessments that speak to privacy, data governance and transparency, and being able to produce that evidence on request, including for systems built outside the jurisdiction.