Article · 10 min read

The Digital Personal Data Protection Act, 2023: DSCI Summary

Data Security Council of India (DSCI) · Data Security Council of India Free Beginner India

DSCI is India's industry body on data security (a NASSCOM initiative), so this is about as close to a canonical plain-language reading of the Act as you get without a lawyer. Three pages, no jargon wall: it lays out who counts as a data fiduciary, the consent and notice rules, the data principal's rights (access, correction, deletion), and breach duties. Read this before you read any blog's interpretation, so you can tell which ones are getting it right.

  • The Act triggers the moment you process digital personal data, and it defines you (the collector) as the data fiduciary carrying the obligations
  • Consent has to be free, specific, informed, and unambiguous through a clear affirmative act, which kills the pre-ticked box
  • Data principals get enforceable rights to access, correct, and erase their data, plus grievance redressal, so your app needs to actually support deletion
Open on dsci.in ↗

The question it answers

  1. I'm building an app that collects user data. What does the DPDP Act actually require me to do?

Read with it

  1. This is the founder-facing counterpart to the DSCI summary: instead of restating the law, it turns it into an 8-step... Corrida Legal Article · 15 min read Compliance under the DPDP Act for startups collecting customer data Corrida Legal
  2. Most privacy policy generators are US-shaped (GDPR or CCPA) and bolt India on as an afterthought. PriView is built India-first... IDfy Tool · 15 min to generate PriView: Free Privacy Notice Generator (by DSCI and Privy/IDfy) DSCI and Privy by IDfy
eChai Partner Brands The partnership →