Glossary · Compliance & filings
DPDP Act 2023 meaning
The DPDP Act 2023 is India's law on processing digital personal data. Learn the key roles, consent, rights and what it means for KYC and onboarding teams.
What does the DPDP Act cover?
The Act, numbered Act 22 of 2023, applies to personal data in digital form, and to data collected on paper that is later digitised. It received assent in August 2023, and the Digital Personal Data Protection Rules, 2025 were notified in November 2025, with different provisions coming into force on different dates. Check the official notification for which obligations apply today.
Who are the key roles under the DPDP Act?
| Role | Who it is |
|---|---|
| Data Principal | The individual the data is about; for a child, the parent or lawful guardian |
| Data Fiduciary | The organisation that decides why and how the data is processed, such as a bank or NBFC |
| Data Processor | A vendor that processes data on the fiduciary's behalf |
| Consent Manager | A registered entity through which a person can give, manage and withdraw consent |
| Data Protection Board | The body that inquires into breaches and complaints |
How does the Act work in practice?
A Data Fiduciary needs a lawful ground to process personal data: either the person's consent, given after a clear notice, or one of the "certain legitimate uses" the Act lists, which include complying with a law. Consent must be free, specific, informed and unambiguous, limited to the stated purpose, and as easy to withdraw as to give. Data Principals have rights to information, correction and erasure, grievance redressal and nominating someone to act for them. Fiduciaries must keep reasonable security safeguards and report personal data breaches.
What does DPDP mean for a KYC journey?
Illustrative example. An NBFC collects documents for a loan on WhatsApp. It shows a short notice saying what data it collects, why, and how to complain. KYC data needed for regulatory compliance is processed for that purpose. A separate, unticked option asks whether the customer wants offers on other products. Three months later the customer withdraws marketing consent; the NBFC stops the offers but keeps the KYC record because other laws require it to be retained.
What do teams get wrong about the DPDP Act?
- Bundling consent. One tick box for onboarding and marketing together is not specific consent.
- Assuming erasure overrides everything. Retention duties under banking and anti-money-laundering rules still apply; work out with your adviser which data must be kept and for how long.
- Forgetting vendors. The fiduciary remains responsible for what its processors do, so contracts and access controls matter.
- Confusing DPDP with RBI KYC rules. The KYC Master Direction says what to collect; DPDP governs how personal data is handled.
How does this affect KYC automation?
Automated onboarding touches the same data, so controls matter: who can read what, where data is stored, and a record of every action. Onboarding and re-KYC automation in AutoKYC run read-only by default, keep one audit log for every read, decision and write, and can run on managed cloud, your VPC or on-premises. The guide on on-premise vs cloud AI for banks and NBFCs covers deployment choices, and our data rights page explains how we handle requests.
This page is a plain-language summary, not legal advice. Confirm obligations with your legal adviser and the official text.
Related terms
Read next
Where this shows up in our work. AutoKYC: Documents read on WhatsApp, checked against your policy, exceptions to a person, maker-checker before the core. Book a 30-minute working session with an engineer.
Questions
What is the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 is India's law governing how organisations process digital personal data. It sets out consent and notice duties, individuals' rights, breach reporting and a Data Protection Board.
Does the DPDP Act apply to banks and NBFCs?
Yes. Banks and NBFCs that process customers' digital personal data act as Data Fiduciaries. Their sector rules, such as RBI KYC directions, continue to apply alongside it, so confirm the interplay with your legal adviser.
When did the DPDP Act come into force?
The Act received assent in August 2023, and the DPDP Rules, 2025 were notified in November 2025 with phased commencement. Check the official Gazette notification for which provisions are in force.