Centre for Police Technology (CPT) presents a 31-Day Cybersecurity Knowledge Series for police personnel, law enforcement agencies (LEAs), corporate investigators, digital forensics professionals and cybersecurity practitioners.
Every time someone downloads an application, opens a bank account, shops online or registers on a digital platform, personal information may be collected and processed. Names, phone numbers, addresses, identity documents, financial details and online identifiers can become valuable targets for cybercriminals.
When this information is exposed, the consequences can include identity theft, financial fraud, impersonation, targeted phishing and other forms of digital exploitation.
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a legal framework for processing digital personal data while recognising individuals’ interests in protecting their information. For investigators, organisations and citizens, understanding the Act is increasingly important as India expands its digital economy.
What Is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023, is an Indian law governing the processing of digital personal data within its scope. It seeks to balance individuals’ rights to protect their personal data with the need to process that data for lawful purposes.
The Act received presidential assent on 11 August 2023. The Digital Personal Data Protection Rules, 2025, were subsequently notified in November 2025, establishing supporting rules for the framework.
The Act addresses the responsibilities of organisations processing personal data, the rights of individuals, the role of the Data Protection Board of India and consequences for specified non-compliance.
An important distinction is that the Act concerns the processing of digital personal data. It is not a general cybersecurity law covering every type of information or security incident.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Counts as Digital Personal Data?
Personal data is information about an individual who is identifiable by or in relation to that information. Under the Act, digital personal data refers to personal data in digital form.
Examples may include:
- Names, phone numbers and email addresses.
- Digital copies of identity documents.
- Online account identifiers associated with identifiable individuals.
- Bank or payment information linked to a person.
- Photographs, recordings or other digital information that identifies an individual.
- Personal information collected through websites, applications and online services.
Not every data item necessarily identifies an individual by itself. Context and the information available alongside it can matter.
The Act also contains provisions concerning its territorial application, including certain processing outside India connected with offering goods or services to individuals within India. Its scope and statutory exclusions must be assessed in the circumstances of each case.
Who Are the Key Stakeholders?
The DPDP Act establishes responsibilities and rights involving several categories of participants.
Data Principal: The individual to whom the personal data relates.
Data Fiduciary: A person who, alone or in conjunction with others, determines the purpose and means of processing personal data.
Data Processor: A person who processes personal data on behalf of a Data Fiduciary.
Data Protection Board of India: The statutory body established under the Act to perform its assigned functions, including dealing with specified non-compliance and complaints under the applicable framework.
For example, an online retailer deciding why customer information is collected may be a Data Fiduciary. A third-party service provider processing that information on the retailer’s behalf may act as a Data Processor.
The precise roles depend on the actual arrangement, rather than simply the name or size of an organisation.
What Responsibilities Does the DPDP Framework Establish?
The Act sets out obligations for Data Fiduciaries, including requirements concerning lawful processing, notices, consent where applicable, security safeguards, personal data breaches and the exercise of individuals’ rights.
Depending on the applicable provisions and circumstances, the framework addresses:
- Notice and consent: Individuals should receive the prescribed information about processing, and consent must meet the statutory requirements where consent is the applicable basis.
- Lawful processing: Personal data must be processed within the framework established by the Act.
- Security safeguards: Appropriate measures are required to protect personal data against personal data breaches.
- Breach response: The Act provides for notifications relating to personal data breaches under the applicable statutory requirements.
- Individual rights: The framework provides specified rights, including access to information about personal data, correction, completion, updating and erasure, subject to the Act.
- Grievance redressal: Mechanisms are provided for individuals to raise grievances under the framework.
- Additional obligations: Certain Data Fiduciaries designated as Significant Data Fiduciaries are subject to additional requirements.
These requirements should not be interpreted as identical obligations for every organisation in every circumstance. Their application depends on the relevant provisions, rules, role of the organisation and commencement schedule.
A Crucial Point: The Act Has a Phased Commencement Schedule
The DPDP Act and Rules were notified before all substantive obligations became operative.
As of 27 October 2026, the Act’s commencement notification provides for a phased implementation:
- Certain institutional and preliminary provisions commenced in November 2025.
- Section 6(9) and Section 27(1)(d) are scheduled to commence one year after the notification published on 13 November 2025.
- Many of the core provisions dealing with processing personal data, individual rights and Data Fiduciary obligations are scheduled to commence eighteen months after that notification, in May 2027.
Therefore, organisations should distinguish between provisions already in force, provisions scheduled to commence later and preparatory work needed for future compliance. The notification and any subsequent amendments or commencement changes should be checked before making legal or compliance decisions.
The phased schedule does not make data protection unimportant in the meantime. Other applicable laws, contractual requirements and cybersecurity obligations may already apply to particular activities.
How Data Breaches Become Cybercrime Investigations
Consider a company that discovers that customer records have been accessed without authorisation. The exposed information includes names, phone numbers, email addresses and details that could help criminals impersonate customers.
Investigators may need to determine:
- How the information was accessed.
- Whether credentials were stolen or access controls were bypassed.
- Which systems and records were affected.
- Whether data was copied, altered, deleted or transferred.
- Whether the information was subsequently used in fraud.
- Which individuals or accounts may be linked to the activity.
A data breach can create several distinct legal questions. Unauthorised access may engage relevant provisions of the Information Technology Act, 2000, or other applicable laws. The DPDP framework addresses the processing of personal data and associated responsibilities within its scope.
A personal data breach is not automatically proof of a criminal offence, and every cybersecurity incident is not necessarily a personal data breach. Investigators must establish the facts and identify the legal provisions that apply.
How Police and Digital Forensic Investigators Should Approach Data Breaches
1. Secure the affected systems
Investigators and incident-response teams should work to contain ongoing unauthorised access while preserving evidence. Actions must be planned carefully so that important logs and forensic artefacts are not unnecessarily destroyed.
2. Preserve system records
Relevant authentication logs, access records, network information, application logs and other artefacts may help establish how the incident occurred. Collection and preservation should be documented.
3. Determine the nature and scope of the exposure
Investigators should identify the categories of information involved, the systems affected and the available evidence concerning access, extraction or disclosure. Conclusions should be proportionate to what the evidence establishes.
4. Establish the timeline
Correlating system events, account activity and relevant communications can help reconstruct the sequence of events. Clock differences and incomplete records should be considered.
5. Trace suspected misuse
Where exposed information is later used in phishing, impersonation or financial fraud, investigators can examine related messages, accounts, transactions and devices to identify possible links.
6. Coordinate with the relevant stakeholders
Depending on the incident, coordination may involve the affected organisation, service providers, financial institutions, cybersecurity response teams and law enforcement agencies. Any disclosure or access to personal information must follow the applicable legal procedures.
7. Assess legal and notification requirements
Organisations should determine which statutory and regulatory obligations apply, including any relevant breach-reporting requirements under laws and rules currently in force. They should not assume that every notification deadline or obligation under the DPDP framework has commenced merely because the Rules have been notified.
What Ordinary People Should Know About Data Protection
Individuals can take practical steps to reduce the risk of their personal information being misused.
- Share identity documents only when necessary and through appropriate channels.
- Avoid posting sensitive personal details publicly.
- Use strong, unique passwords and enable multifactor authentication where available.
- Review application permissions and remove access that is no longer needed.
- Be cautious of messages that use personal information to create urgency or impersonate a trusted institution.
- Never disclose OTPs, banking PINs or passwords to callers claiming to verify your identity.
- Report suspected account compromise or financial fraud promptly.
If personal information is exposed, individuals should secure affected accounts, contact the relevant service provider and preserve suspicious messages or notifications. If money is lost to cyber fraud in India, contact the bank or payment provider immediately and call 1930. Complaints can also be filed through the official National Cyber Crime Reporting Portal at cybercrime.gov.in.
DPDP Act and the Future of Cybersecurity
Data protection is becoming an important part of cybersecurity governance. Organisations increasingly need to understand what personal data they hold, why they process it, who can access it and how it is protected.
Privacy-aware system design, access controls, encryption, employee training, vendor assessments and incident-response planning can reduce the risk of exposure and misuse.
Artificial intelligence adds another dimension. AI systems may process large volumes of personal data, while synthetic content and automated profiling can create new privacy and security risks. Organisations should assess these activities against applicable legal requirements rather than assume that using AI automatically permits any form of data processing.
For police and investigators, the challenge is to balance effective evidence collection with lawful access, privacy safeguards and proper documentation. For organisations, the priority is to prepare for applicable obligations and build responsible data-handling practices.
Conclusion: Personal Data Is More Than Information
Personal data can influence a person’s financial security, privacy, reputation and safety. When exposed or misused, it can become the starting point for fraud, impersonation and further cybercrime.
The DPDP Act, 2023, establishes a framework for protecting digital personal data and defining responsibilities for its processing. Its effectiveness will depend on implementation, organisational preparedness, public awareness and appropriate enforcement.
In a digital economy, protecting personal data is not merely a technical responsibility. It is a legal, operational and public-trust imperative.
Day 27 — Digital Personal Data Protection (DPDP) Act, 2023
31 Days | 31 Key Topics | October 2026
Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
