About this reference
Sources, method, and what is still open.
What this is
A free, open-source reference for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and the knowledge base behind the dpdp-analyze skill for Claude Code. The same Markdown files power both: this site is generated from them, so the page you read and the text the skill quotes are identical.
Sources
- The Act is reproduced verbatim from the Gazette of India, Extraordinary, Part II, Section 1, No. 25, dated 11 August 2023 (CG-DL-E-12082023-248045). Nothing in the operative text is paraphrased. Reproduction is permitted under section 52(1)(q) of the Copyright Act, 1957.
- The Rules content is secondary. It was assembled from the PIB release and multiple independent sources cross-checked against each other, not transcribed from the Gazette. Verify against the notified text at meity.gov.in or egazette.gov.in before relying on it.
- Commentary (the explainer, checklist, glossary notes and FAQ) is interpretation. Every claim is meant to be traceable to a section or rule; one that is not is a bug.
What is still open
As at the last check: no Significant Data Fiduciary has been notified, no country is restricted under section 16(1), no startup relief has been notified under section 17(3), the Rule 13(4) localisation committee has not published its categories, “significant” in section 33(1) is undefined, and there is no Board jurisprudence.
Maintainer
Maintained by Mayank Dsouza, who is not a lawyer. This is not legal advice. See the disclaimer.
Corrections
Corrections to statutory text take priority over everything else. Open an issue with the section or rule number, the text as it appears here, the Gazette text, and the Gazette reference you checked.
Last updated . Report an error.