DPDP Act (India)

The DPDP Act is India's data protection law requiring clear consent, backed by a plain-language notice, before you collect and process someone's personal data.

The Digital Personal Data Protection Act passed in 2023, and its operating rules were notified on November 14, 2025, with enforcement phased in over the following period stretching toward 2027. It asks you to give each person a clear notice of what you collect and why, obtain consent that is specific and revocable, and let them withdraw as easily as they gave it.

Imagine you capture leads from users in Mumbai. Under DPDP you show a notice spelling out the purpose, collect a genuine opt-in, and keep a record. If someone later withdraws, you stop processing and honor it without friction.

The phased timeline gives you runway, but it is not a reason to wait. The catch is that consent under DPDP is purpose-bound, so a single blanket yes does not cover new uses. Reuse the data for something you did not name and the original consent will not stretch to cover you.

Name the purpose or lose the permission.