DPDP Act Kya Hai? Digital Personal Data Protection Act 2023 in Hindi, Simple Bhasha Mein

DPDP Act kya hai? Full form aur basic idea

DPDP Act full form hai Digital Personal Data Protection Act, 2023. Parliament ne ise August 2023 mein pass kiya aur 11 August 2023 ko Presidential assent mila. Yeh kanoon personal data ko protect karta hai, yaani aisa koi bhi data jisse kisi individual ki pehchaan ho sake (section 2(t)).

Act ka basic idea simple hai. Company aapka data sirf lawful purpose ke liye process kar sakti hai, ya to aapki consent se, ya kuch “legitimate uses” ke liye jo section 7 mein listed hain (section 4). Company ko data secure rakhna hai, purpose khatam hone par delete karna hai, aur breach hone par aapko aur Data Protection Board of India ko batana hai.

Act ke saath DPDP Rules, 2025 hain, jo 13 November 2025 ko Gazette mein publish hue. DPDP Rules 2025 in Hindi samjhein to: Act batata hai “kya karna hai”, Rules batate hain “kaise karna hai”. Jaise Rule 3 notice ka format, Rule 6 security ke minimum measures, aur Rule 7 breach report ka 72 ghante ka timeline.

DPDP Act kis par lagu hota hai?

Section 3 ke under, Act India mein digital personal data ki processing par lagu hota hai, chahe data digital form mein collect hua ho ya paper par collect hokar baad mein digitise hua ho. India ke bahar ki processing bhi cover hoti hai agar woh India mein logon ko goods ya services offer karne se judi hai.

Koi size limit nahi hai. Ek 10 logon ka Jaipur ka clinic, ek Delhi D2C brand, ek Bengaluru SaaS startup aur ek bada bank, sab par core duties lagu hoti hain. Sirf woh companies jinhe sarkar Significant Data Fiduciary notify kare, unpar section 10 ki extra duties aati hain.

Do cheezein bahar hain (section 3(c)): koi individual apne personal ya domestic kaam ke liye data process kare, aur woh data jo khud Data Principal ne, ya kanoon ke under kisi ne, publicly available kiya ho. Section 17(3) ke under sarkar startups jaisi classes ko kuch provisions se partial chhoot de sakti hai, lekin as of October 2026 aisi koi notification known nahi hai.

Data fiduciary kya hota hai? Teen roles ka matlab

DPDP Act mein teen main roles hain, aur inhe samajhna sabse zaroori hai.

• Data Principal (section 2(j)): woh individual jiska data hai, jaise customer, employee ya patient. Bachche ke case mein parent ya lawful guardian bhi isme shamil hain.
• Data Fiduciary (section 2(i)): woh person ya company jo akele ya dusron ke saath decide karti hai ki data kyun aur kaise process hoga. Data fiduciary kya hota hai, iska simple jawab: jo “kyun” decide kare. Usually yeh aapki company hoti hai.
• Data Processor (section 2(k)): jo fiduciary ki taraf se data process karta hai, jaise payroll vendor, cloud host, CRM ya call centre. Act processor par direct duties nahi daalta; uski zimmedari contract ke through aati hai.

Consent aur notice: company ko kya batana padega?

Section 6(1) ke under consent free, specific, informed, unconditional aur unambiguous honi chahiye, clear affirmative action ke saath, aur sirf utne data tak limited jitna purpose ke liye zaroori hai. Pehle se tick kiya hua box ya “by using this app you agree” jaisa wording is standard par shayad khara na utre.

Consent maangne se pehle ya saath mein company ko notice dena hoga (section 5). Rule 3 kehta hai ki notice alag se samajh aane wala ho, clear aur plain language mein, itemised data aur specific purpose ke saath, aur consent withdraw karne, rights use karne aur Board ko complaint karne ka tareeka bataye. Section 5(3) ke under notice English ya Eighth Schedule ki kisi bhi bhasha mein access karne ka option dena hoga.

Section 6(4) ke under aap consent kabhi bhi wapas le sakte hain, aur wapas lena utna hi aasaan hona chahiye jitna dena tha. Section 7 kuch legitimate uses allow karta hai, jaise employment ke purposes, jahan consent zaroori nahi hoti.

Aapke rights kya hain? Sections 11 se 14

Rights ke saath kuch duties bhi hain (section 15): impersonation nahi karna, false ya frivolous complaint nahi karna, aur sirf authentic information dena. Inke breach par ₹10,000 tak penalty ho sakti hai.

• Right to access information (section 11, jahan processing consent ya section 7(a) par ho): apne data ka summary, processing activities, aur un sab Data Fiduciaries aur Data Processors ki identity jinke saath data share hua.
• Right to correction and erasure (section 12): galat data theek karwana, adhoora data poora karwana, update karwana, aur erasure maangna, jab tak kanoon ya purpose ke liye rakhna zaroori na ho.
• Right of grievance redressal (section 13): company ke paas complaint ka aasaan tareeka hona chahiye. Board ke paas jaane se pehle yeh raasta use karna zaroori hai (section 13(3)). Rule 14(3) ke under company ko 90 din se zyada ka response period publish nahi karna chahiye.
• Right to nominate (section 14): death ya incapacity ki situation mein aapke rights use karne ke liye kisi ko nominate karna.

Company ki duties kya hain? Section 8 simple bhasha mein

Section 8 Data Fiduciary ki general obligations batata hai. Sabse important baat section 8(1) mein hai: company apne vendor ki processing ke liye bhi zimmedar hai, “irrespective of any agreement to the contrary”. Yaani contract mein likh dene se ki “vendor responsible hai”, Board ke saamne company bach nahi sakti.

• Vendor ko sirf valid contract ke under use karna (section 8(2)).
• Decision lene ya data share karne se pehle data accurate aur complete rakhna (section 8(3)).
• Reasonable security safeguards lena (section 8(5)). Rule 6 minimum measures batata hai: encryption ya masking, access control, logs aur monitoring, backups, aur logs ko ek saal tak rakhna.
• Breach hone par Board aur har affected person ko batana (section 8(6)). Rule 7 ke under pehli suchna “without delay”, aur Board ko detailed report 72 ghante ke andar.
• Purpose khatam hone ya consent wapas lene par data delete karna, aur vendor se bhi delete karwana (section 8(7)).
• DPO (agar applicable ho, yaani Significant Data Fiduciary ke liye, section 10(2)(a)) ya contact person ki details publish karna (section 8(9)) aur grievance redressal system rakhna (section 8(10)).

Bachon ka data: section 9 ke extra rules

DPDP Act mein 18 saal se kam umar ka har vyakti “child” hai (section 2(f)). Section 9 ke under bachche ka data process karne se pehle parent ya lawful guardian ki verifiable consent leni hogi. Aisi processing nahi ho sakti jo bachche ki well-being par bura asar daale, aur bachchon ki tracking, behavioural monitoring ya unhe target karke advertising nahi ki ja sakti.

Rule 12 aur Rules ki Fourth Schedule mein kuch classes aur purposes ko, jaise health aur education services, sirf section 9(1) aur 9(3) se limited chhoot hai. Is duty ke breach par ₹200 crore tak penalty ho sakti hai. Ed-tech, gaming ya kids ke products wali companies ko yahan khaas dhyan dena chahiye.

DPDP Act penalty in Hindi: kitna jurmana lag sakta hai?

Section 33 aur Schedule ke under penalty Data Protection Board lagata hai, inquiry ke baad, aur sirf tab jab breach “significant” ho. Neeche diye amounts maximum hain, fixed nahi. Board section 33(2) ke factors dekhta hai, jaise breach ki gravity, duration, data ka type, aur company ne kitni jaldi mitigation kiya.

DPDP Act kab se lagu hoga?

Act teen phases mein lagu ho raha hai, notification G.S.R. 843(E) ke under. Yeh dates as of October 2026 hain. Early 2026 mein sarkar ne 18 mahine ki window chhoti karne ka proposal diya tha; October 2026 tak koi aisi notification publish nahi hui, lekin nayi notification ke zariye date pehle laayi ja sakti hai.

Vendor contracts kyun important hain?

Zyada tar companies ka data sirf unke paas nahi, unke vendors ke paas hota hai: payroll, CRM, cloud, logistics, support desk. Section 8(1) kehta hai ki vendor ki galti ki zimmedari bhi aapki hai. Aur Act ya Rules vendor ke liye breach batane ki koi deadline set nahi karte, jabki aapki 72 ghante ki clock aapke aware hone se chalti hai.

Isliye vendor contract mein recommended practice ke taur par yeh cheezein honi chahiye: roles clear hon, purpose limited ho, Rule 6 wala security schedule ho, breach notice ki fixed deadline (jaise 24 ghante) ho, erasure aur ek saal ke log retention ka clause ho, sub-processor list ho, aur liability cap data breach ke risk ke hisaab se ho. Rule 6(1)(f) khud contract mein security provision ki baat karta hai.

November 2025 se pehle sign hue kai contracts shayad DPDP ke baare mein kuch nahi kehte, aur aaj sign ho rahe contracts 13 May 2027 ke baad tak chalenge.

ClauseAudit se contract check: kya milta hai aur kab advocate chahiye?

Problem seedhi hai. Section 8(1) ke under vendor ki processing ki zimmedari aapki hai, security failure par ₹250 crore tak penalty ho sakti hai, aur kai purane contracts mein shayad DPDP ka zikr hi nahi hai.

Teen honest options hain. Advocate ka review thorough hota hai aur bade deals ke liye sahi hai, lekin time aur paisa zyada lagta hai. Free checklist fast hai, par har clause aapko khud padhna aur judge karna hoga. ClauseAudit ka DPDP Compliance Check vendor agreement, DPA ya SaaS terms ko clause by clause minutes mein padhta hai, ₹999 per contract plus GST mein. Har finding par label hota hai: Act ya Rules se required (section ya rule ke saath), ya recommended practice. Aapko clause quote, risk ka reason, suggested fix, redline aur negotiation email milta hai, customer ya vendor kisi bhi side se. Original document review ke baad store nahi hota.

Yeh AI-assisted review hai aur kuch miss kar sakta hai. Bade ya sensitive deals, bachon ka data bade scale par, ya banking, insurance aur health jaise regulated sectors mein advocate se review karwaiye.

Aage padhiye

Detail ke liye hamari DPDP compliance checklist, DPDP penalties, enforcement timeline, breach notification, section 8, data fiduciary vs data processor roles aur data processing agreement clauses wali guides dekhiye, aur free data processing addendum template bhi. Yeh guide general jaankari hai, legal advice nahi.