What this topic covers
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data-privacy law. It defines who is responsible for personal data (the Data Fiduciary), who the data belongs to (the Data Principal), and what each party can and must do. Most explainer videos on this topic walk through these roles in the first three minutes so viewers can place themselves on the map before the obligations kick in.
The middle section of any good DPDP explainer covers the three pillars: notice (Section 5), consent (Section 6) and legitimate uses (Section 7). Notice must be itemised in plain language; consent must be free, specific, informed, unambiguous and as easy to withdraw as to give; legitimate uses are limited — cookies almost never qualify. The Act sits on top of the DPDP Rules 2025 notified by MeitY on 13–14 November 2025, with full compliance required by 13 May 2027.
The last section of any complete explainer covers enforcement: the Data Protection Board of India, the five graded penalty bands in the Schedule (up to ₹250 crore for Section 8(5) security-safeguard failures), and the six Section 33(2) factors the Board must weigh before setting an actual number. The Section 33(2) framework is the most-skipped part of every viral explainer — and it's what makes documented compliance meaningfully cheaper than no compliance.
Points a complete video on this topic should cover
- Who the Act applies to (any business processing personal data of people in India, including foreign businesses)
- Data Principal, Data Fiduciary, Data Processor, Consent Manager and Significant Data Fiduciary definitions
- Section 5 — itemised notice in plain language, English + 22 Eighth-Schedule languages
- Section 6 — free, specific, informed, unambiguous consent with the right to withdraw
- Section 7 — limited "legitimate uses" carve-out
- Section 8 — Data Fiduciary obligations (security safeguards, breach notification, processor compliance, Grievance Officer)
- Sections 11–14 — the five Data Principal rights
- Schedule penalty bands and Section 33(2) mitigation factors
- The 13 May 2027 full-compliance deadline
Relevant sections of the DPDP Act / Rules
- Section 1–2 (scope)
- Section 5 (notice)
- Section 6 (consent)
- Section 8 (obligations)
- Section 33 (penalties)