India's DPDPA 2023: What It Means for Your Online Privacy

What Is the DPDPA 2023?

The Digital Personal Data Protection Act 2023 (DPDPA) is India's landmark data privacy law, signed into law on August 11, 2023. It came into enforcement in 2026 after the government notified its rules.

The DPDPA establishes a legal framework for how companies (Data Fiduciaries) must handle personal data of Indian citizens (Data Principals). It's modeled partly on the EU's GDPR but tailored for India's context.

Key Terms to Know

Term	Meaning
**Data Principal**	You — the individual whose data is being processed
**Data Fiduciary**	Any company/organization that processes your personal data
**Significant Data Fiduciary**	Large companies with high data volumes, designated by the government for extra obligations
**Data Processor**	A third party that processes data on behalf of a Data Fiduciary
**Personal Data**	Any data that can identify you — name, email, phone, IP address, etc.

Your Rights as a Data Principal

The DPDPA gives you 5 fundamental rights:

1. Right to Access Information

You can ask any Data Fiduciary: "What personal data do you have about me, and why are you processing it?" They must respond within a reasonable timeframe.

2. Right to Correction & Erasure

You can ask them to correct wrong data about you, or delete data that's no longer needed. This is similar to GDPR's "right to be forgotten."

3. Right to Grievance Redressal

Every Data Fiduciary must have a Grievance Officer you can contact. They must acknowledge your complaint within 48 hours and resolve it within 15 business days.

4. Right to Nominate

Unique to DPDPA: you can nominate another person (a family member, trusted friend) to exercise your data rights on your behalf if you become incapacitated or pass away.

5. Right to Withdraw Consent

If a company is processing your data based on consent (rather than a legal obligation), you can withdraw that consent at any time.

What Companies MUST Do Under DPDPA

Before processing your data:

Obtain your explicit, free, specific, and informed consent

Provide a clear notice of what data is collected and why

Not use dark patterns or confusing language in consent forms

While processing your data:

Process only the minimum data necessary (data minimization)

Keep data accurate and up to date

Implement appropriate security safeguards

Delete data when no longer needed

If there's a breach:

Notify the Data Protection Board (government regulator)

Notify affected individuals promptly

Take remedial action

Children's Privacy Under DPDPA

The DPDPA defines a child as any person under 18 — stricter than GDPR's 16 and COPPA's 13. Companies must:

Obtain verifiable parental consent before processing a child's data

Not process data in a way that can harm children

Not serve tracking or behavioral advertising to children

Penalties for Non-Compliance

The DPDPA has significant teeth:

Violation	Maximum Fine
Inadequate security measures leading to breach	₹250 crore (~$30M)
Failure to notify breach	₹200 crore (~$24M)
Processing children's data without consent	₹200 crore
General non-compliance	₹50 crore (~$6M)

How DoctorDocs Complies With DPDPA 2023

✅ We have appointed a Grievance Officer (Prabhu Chaturvedi, prabhu@doctordocs.in)

✅ Core tools process data locally in your browser — no personal data transmitted

✅ We collect minimum data — only email for paid accounts

✅ We provide a full Privacy Policy with all required disclosures

✅ We have a Cookie Policy with opt-out mechanisms

✅ We notify users of material policy changes 30 days in advance

What To Look For When Choosing Online Services

When using any online service as an Indian user, check for:

A Grievance Officer — listed with contact details and response time

Clear consent notices — before any data collection

Data retention policy — how long do they keep your data?

Breach notification commitment — will they tell you if your data is exposed?

Children's data policy — especially important for educational tools

Practical Tips to Protect Your Data

Use browser extensions like uBlock Origin to block trackers

Choose tools that offer local processing (like DoctorDocs) for sensitive documents

Read privacy policies — at least the summary/highlights

Exercise your right to erasure when you stop using a service

Use a dedicated email address for sign-ups to limit exposure

Enable two-factor authentication everywhere

---

*Have questions about your privacy rights when using DoctorDocs? Contact our Grievance Officer at prabhu@doctordocs.in.*