Quick Answer
The DPDP Act 2023 is a significantly simplified version of the Personal Data Protection Bill 2019 — it removes data localisation mandates, eliminates the category of sensitive personal data, and adopts a consent-or-legitimate-use binary framework. The 2023 Act focuses on practical compliance rather than the GDPR-inspired complexity of the 2019 Bill. Understanding the differences helps organisations that prepared for the 2019 Bill recalibrate their compliance programmes.
Quick AnswerDPDP Act 2023 is leaner than PDPB 2019: it removed data localisation as a default requirement, dropped the 'sensitive personal data' category, simplified consent mechanics, and removed specific provisions on non-personal data governance.
DPDP Compliance Checklist
- Understand that 'sensitive personal data' as a separate category was removed — DPDP has one tier
- Note data localisation is no longer a default requirement — government may notify restrictions later
- Understand the shift to binary consent model — no explicit sensitive data enhanced consent
- Review removal of non-personal data provisions — separate NPDR framework expected later
- Note removal of mandatory DPO for all large organisations — only SDFs must appoint DPO
- Understand simplified consent framework — granular, affirmative, but less prescriptive on format
- Review removal of data protection by design as an explicit provision — remains good practice
- Note stronger focus on purpose limitation and data minimisation as core principles
- Review new consent manager framework — intermediaries to manage consent at scale
- Monitor for DPDP Rules 2025 which add operational specifics to the 2023 Act
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Why was the PDPB 2019 withdrawn?+
The Joint Parliamentary Committee recommended significant changes. Rather than amend PDPB 2019 extensively, the government started fresh with DPDP Act 2023, which is a shorter, principles-based law.
Is the DPDP Act 2023 weaker than PDPB 2019?+
In some areas yes (data localisation, sensitive data categories), in others the 2023 Act is more practical and implementable. The Rules 2025 add operational detail.
Do organisations that prepared for PDPB 2019 need to redo their compliance?+
Most PDPB 2019 preparation — data mapping, consent frameworks, security controls — remains relevant for DPDP 2023. Update consent mechanisms and review the SDF/DPO obligations specifically.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
