Law note · India
Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basis
What it requires
- India's Digital Personal Data Protection Act has not yet begun to bind app developers as of this document's as_of_date; its lawful-basis and consent duties are scheduled to commence 14 May 2027. Once in force, an app that collects, uses, or discloses the personal data of an individual in India, including a voiceprint, faceprint, or other biometric identifier, which the Act treats as ordinary personal data since it has no separate sensitive-category tier, will need a lawful basis under section 4, ordinarily the data principal's free, specific, informed, and unambiguous consent under section 6, or one of section 7's enumerated legitimate uses.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
The DPDPA is India's first comprehensive personal-data statute, defining "personal data" broadly and technology-neutrally as any data about an identifiable individual (s.2(t)), with no separate sensitive or special-category tier for any kind of data, biometric included.
A Data Fiduciary must have a lawful basis under s.4 before processing, ordinarily the data principal's free, specific, informed, unconditional and unambiguous consent under s.6, or one of s.7's enumerated legitimate uses (voluntarily-provided data for a specified purpose, state functions, employment, medical emergency). A Data Fiduciary bears general erasure (s.8(7)) and security-safeguard (s.8(5)) duties.
None of ss.4, 6, 7, or 8 have commenced: Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as their commencement date under clause (c); that calendar date is arithmetic on the notification's own offset, not a separately printed date. Section 2's definitions, by contrast, came into force on the notification's publication date itself, 13 November 2025, under clause (a).