What is the DPDP Act?

Short answer

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law on how organisations collect and use people's digital personal data. It requires clear, specific consent (or another lawful ground), purpose limitation, reasonable security safeguards and breach notification. It gives individuals rights to access, correct and erase their data. Penalties go up to ₹250 crore per breach.

Hindi mein samjhiye

DPDP Act 2023 India ka data privacy kanoon hai. Company ko aapka personal data lene se pehle saaf consent lena hoga, sirf batae gaye kaam ke liye use karna hoga, aur surakshit rakhna hoga. Aap apna data dekh, sudhaar aur delete karwa sakte hain. Galti par ₹250 crore tak penalty ho sakti hai.

Key terms

Data Principal: the person the data is about.
Data Fiduciary: the organisation deciding why and how data is processed, such as a bank.
Data Processor: a vendor processing data on the fiduciary's behalf.
Consent Manager: a registered entity that lets people give, manage and withdraw consent across fiduciaries.
Data Protection Board: the adjudicating body for complaints and penalties.

What banks, NBFCs and fintechs must do

Give notices in clear language (and in Indian languages on request) saying what data is collected and why.
Collect only what the purpose needs, and delete it when the purpose ends, unless another law such as RBI or PMLA retention requires keeping it.
Honour access, correction, erasure and grievance requests.
Secure data, hold vendors to the same standard, and report breaches to the Board and affected people.

DPDP vs RBI data rules

DPDP is a general law. BFSI firms also follow sector rules such as RBI's payment data localisation and KYC record retention. Where a sector law requires retention, it applies alongside DPDP. Hosting in India and purpose-scoped access help satisfy both. See how ZyroAI approaches this.

Common questions

What is the DPDP Act 2023?

India's Digital Personal Data Protection Act, which governs how organisations collect, use and protect digital personal data, with consent and individual rights at its core.

What is a consent manager under the DPDP Act?

A registered entity that gives individuals one interface to give, review and withdraw consent across multiple data fiduciaries.

What is the maximum penalty under DPDP Act?

Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach.

DPDP Act kya hai?

DPDP Act 2023 India ka personal data suraksha kanoon hai: consent, data ka seemit use, aur aapke data par aapke adhikaar.

Account AggregatorAn Account Aggregator (AA) is an RBI-licensed NBFC that moves your financial data between institutions only with your explicit, revocable consent.Aadhaar eKYCAadhaar eKYC is electronic identity verification using UIDAI's Aadhaar system.Transaction monitoring (AML)Transaction monitoring is the continuous review of customer transactions to spot activity that may indicate money laundering, terror financing or fraud.

ZyroAI products for this: Digital KYC · ZyroAI Sentinel.

Written by the ZyroAI team for people building in Indian BFSI. Regulatory rules change, so for binding requirements check the current RBI, NPCI, UIDAI or relevant regulator circular. Last updated 2026-09-24.

← All explainers