DPDP Act, 2023

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's main law on personal data protection. It governs how organizations process digital personal data, and personal data collected offline and later digitised. The government notified the DPDP Rules in 2025, with obligations being phased in over a transition period, so organizations should check which provisions apply now and which come into effect later.

Key concepts:

• Data Principal – the individual the data is about, such as an employee
• Data Fiduciary – the organization that decides why and how data is processed, such as an employer
• Data Processor – a party that processes data on the fiduciary's behalf, such as a benefits or health services vendor
• Consent and legitimate uses – processing generally needs clear, informed consent, though the Act also allows certain "legitimate uses", including some employment-related purposes
• Rights – individuals can access information about their data, seek correction and erasure, and have grievances addressed
• Security safeguards and breach notification – fiduciaries must protect data and report personal data breaches
• Data Protection Board of India – the body that handles complaints and can impose significant financial penalties

The Act does not create a separate "sensitive data" category, but health information is deeply personal, and handling it carelessly can seriously harm employees and trust.

Why it matters for employers

Benefits administration for health involves a lot of personal data: health checkup reports, health risk assessments, claims, counselling records and family details. Under the DPDP Act, employers and their vendors need to think carefully about:

1. Purpose – collect only what is needed for a clear purpose
2. Consent and notice – explain in plain language what is collected, why and who will see it
3. Access – keep individual health data with clinicians and the employee; give HR only aggregated, anonymised reports
4. Vendors – ensure contracts with processors cover security, use limits and deletion
5. Retention – delete data when it is no longer needed, subject to other legal retention requirements

Because the rules are being phased in, confirm timelines and specific obligations with counsel.

Example

Before running annual health checkups, an employer shares a notice explaining that reports go directly to employees and the doctor, that HR will see only anonymised, group-level insights, and how employees can raise questions. The checkup vendor's contract limits data use to delivering the service and requires secure deletion after the agreed retention period.

Key takeaways

• The DPDP Act sets rules for processing digital personal data in India.
• Employers are data fiduciaries; benefits vendors are typically processors.
• Health data needs strict purpose limits, access controls and clear notices.
• See how MeWeSalus Care approaches security and compliance.

← Back to the glossary