- Why in news
- PIB marked International Data Privacy Day (28 January) on 27 January 2026 with a explainer on the DPDP Act, 2023 and the DPDP Rules, 2025 and India's cybersecurity measures.
- What it is
- The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India, including offline data that is later digitised. It sets rights for individuals (Data Principals) and duties for entities that decide how data is used (Data Fiduciaries). The DPDP Rules, 2025 make the Act operational.
- Enactment
- The DPDP Act was enacted on 11 August 2023 and covers digital personal data, including digitised offline data.
- DPDP Rules
- The Rules were notified on 13 November 2025 to operationalise the Act.
- Data Protection Board of India
- The Act sets up the Board to oversee compliance, inquire into breaches and ensure corrective action.
- Response time
- Data Fiduciaries must address access, correction, updating or erasure requests within a maximum of ninety days.
- Children's data
- Verifiable parental or guardian consent is needed for a child's data, except for essential services such as healthcare, education or real-time safety.
Don’t confuse with Data Fiduciary vs Data Principal: The Fiduciary decides why and how data is processed. The Principal is the individual the data relates to, including a parent or lawful guardian for a child or a person with disability.
Don’t confuse with DPDP Act vs IT Act, 2000: The IT Act is the core cyber law (e-records, CERT-In, blocking under Section 69A). The DPDP Act deals specifically with personal data processing and rights.
Laws, judgments and statutory bodies: 30 Prelims questions since 2013 (what the law says, who chairs, legal basis). In Mains, 44 news-triggered questions, most in GS2, asking for provisions and challenges.
Why it matters
- Gives citizens enforceable rights over personal data and makes organisations accountable.
- Balances privacy with innovation and public-interest data use in a large digital economy.
Problems
- Balancing exemptions for State processing with privacy protection.
- Ensuring compliance and awareness across many entities, including small ones.
Way forward
- Build the Data Protection Board's capacity and ensure timely redressal.
- Promote privacy by design and public awareness among Data Principals.
Put in your answer
Cybersecurity allocation: ₹782 crore was allocated for cybersecurity in Budget 2025-26 to protect digital public infrastructure.
I4C: The Indian Cyber Crime Coordination Centre under MHA is the national nodal agency against cybercrime.
Puttaswamy judgment: The 2017 Supreme Court judgment in Justice K.S. Puttaswamy v. Union of India held privacy to be a fundamental right under Article 21.
- 2024Mains GS3 · Q10Describe the context and salient features of the DPDP Act, 2023.
- 2018Mains GS3 · Q19Strengths and weaknesses of Srikrishna Committee report on personal data protection.
- 2024Mains GS2 · Q12Explain privacy under Article 21 and law on DNA testing of unborn child.
- 2019Prelims Q88Which entity adopted GDPR data protection law in 2016, implemented from 2018?
- 2021Prelims Q79Under which Article is the Right to Privacy protected in India?
- 2024Prelims Q76Under which Article did the Supreme Court place the Right to Privacy?
UPSC’s own questions that come close to this issue, from our Prelims and Mains banks.
No practice question for this one; the card may still help an answer. Why: Lasting law on the syllabus. This release is an awareness explainer with no new decision; laws are 23 of 327 Prelims questions, but no fresh trigger here.
Worth revising until Prelims 2027: most news questions come within two years of the event.