Module 1: Introduction to DPDPA 2023
India’s first dedicated law on digital personal data: why it exists, who it covers, how it differs from GDPR, and the timeline for compliance. This DPDPA 2023 course page explains introduction to dpdpa 2023 in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Module 1 lessons (about 3 hours) (introduction to dpdpa 2023)
Work through the eight lessons in order. Each has reading, a click-through diagram, a short activity and a quiz.
Total: 195 minutes of study time, plus the practical guides below.
What you will learn about introduction to dpdpa 2023
- Explain why the DPDP Act, 2023 was enacted
- Decide whether an organisation falls within its scope
- Understand the phased timeline under the DPDP Rules, 2025
- Compare DPDPA with GDPR at a high level
Why DPDPA exists
The Supreme Court recognised privacy as a fundamental right in K.S. Puttaswamy v. Union of India (2017). The Digital Personal Data Protection Act, 2023 (assented 11 August 2023) turns that principle into a consent-based framework and replaces the older Section 43A IT Act regime.
- Covers digital personal data, and non-digital data that is later digitised
- Applies to processing inside India
- Also applies outside India if connected to offering goods or services to people in India
- Does not apply to purely personal or domestic use, or to data a person has made public themselves
Timeline at a glance (introduction to dpdpa 2023)
The DPDP Rules, 2025 were notified in November 2025 and bring the Act into force in phases.
- 13 November 2025 (Gazette date): Rules 1, 2 and 17 to 21 on the Data Protection Board
- 13 November 2026 (12 months after publication): Rule 4 on Consent Managers
- 13 May 2027 (18 months after publication): the core duties on notice, security, breach reporting, erasure, children, rights and more
- Always confirm the latest dates on the official MeitY website
DPDPA vs GDPR in five lines
Both are rights-based, but the designs differ.
- No separate “sensitive personal data” category in DPDPA
- No “legitimate interest” ground; DPDPA uses consent plus a list of “legitimate uses”
- Child means anyone under 18
- Regulator is the Data Protection Board of India, with appeals to TDSAT
- Cross-border transfers are allowed unless a country is restricted by notification
DPDPA is consent-first, digital-first and applies to almost every organisation that handles personal data of people in India.
Check your understanding of introduction to dpdpa 2023
Q1. Which data does the DPDP Act cover?
Q2. Which case recognised privacy as a fundamental right?
Q3. When does DPDPA reach processing outside India?
Quick FAQs (introduction to dpdpa 2023)
Does DPDPA cover offline records?
Only if the data is digitised. Purely paper records that are never digitised fall outside the Act.
Is there a sensitive data category?
No. All personal data is treated under the same framework, though security must match the risk.
Do it yourself: practical guides
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.