{"id":14451,"date":"2025-08-24T10:35:20","date_gmt":"2025-08-24T05:05:20","guid":{"rendered":"https:\/\/blogs.enkash.com\/?p=14451"},"modified":"2025-12-15T14:20:14","modified_gmt":"2025-12-15T08:50:14","slug":"what-is-the-dpdp-act","status":"publish","type":"post","link":"https:\/\/www.enkash.com\/resources\/blog\/what-is-the-dpdp-act","title":{"rendered":"What Is the DPDP Act and How It Impacts Indian Fintech Companies"},"content":{"rendered":"

<\/span>What is the DPDP Act?<\/span><\/h2>\n

The DPDP Act, or Digital Personal Data Protection Act, is India\u2019s primary law that governs how personal data should be collected, stored, processed, and protected in digital form. It was passed in August 2023 to give Indian citizens clear rights over their personal information and to set defined responsibilities for businesses, including fintech companies, digital lenders, payment apps, and financial institutions.<\/p>\n

Before the DPDP Act, India did not have a dedicated, modern data protection law that applied to digital personal data. Companies collected and used user information with limited accountability. The DPDP Act fills this gap by establishing a national framework that ensures transparency, consent-based data usage, stronger security controls, and significant penalties for misuse or data breaches.<\/p>\n

In simple terms, the DPDP Act tells companies what they can and cannot do with a person\u2019s digital data. It helps customers understand their rights and creates a compliance framework businesses must follow to operate responsibly within India\u2019s digital ecosystem.<\/p>\n

<\/span>How the DPDP Bill 2023 Became the DPDP Act<\/span><\/h2>\n

The DPDP Bill 2023 was the final draft of India\u2019s data protection framework before it was passed in Parliament. It was built on earlier drafts released in 2018, 2019, and 2021 and was designed to create a simpler and more practical privacy law for India\u2019s digital environment. Once the Bill was approved by both Houses of Parliament in August 2023, it became the Digital Personal Data Protection Act 2023.<\/p>\n

While the Act was passed in 2023, the detailed compliance rules were later finalised through the Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and IT (MeitY) in the Official Gazette in November 2025. These Rules include requirements for notices and consent, breach reporting, cross-border data transfers, data retention timelines, and obligations for significant data fiduciaries.<\/p>\n

Because of these updates, the DPDP Bill 2023 is considered the legal foundation, and the DPDP Act 2023, together with the DPDP Rules 2025, now determine how businesses must comply. This two-step approach allows India to create a strong privacy law while giving companies time to adapt.<\/p>\n

<\/span>Key Features of the DPDP Act<\/span><\/h2>\n

The DPDP Act translates its objectives into specific obligations and rights. Some of the most important features are listed below.<\/p>\n

1. Consent Is the Core Requirement<\/h3>\n

Organisations must take clear and specific consent before collecting personal data. The consent request should be easy to understand and must explain the purpose of data collection. People should also be able to withdraw consent at any time without difficulty.<\/p>\n

2. Purpose-Limited Data Use<\/h3>\n

Businesses can only use personal data for the purpose they shared at the time of collection. If the purpose changes, they need new consent. This ensures that companies do not use or repurpose customer information in unexpected ways.<\/p>\n

3. Data Minimisation<\/h3>\n

Only the data necessary for providing a service should be collected. Fintech companies, for example, must collect only what is required for onboarding, KYC, risk checks, or transaction processing.<\/p>\n

4. User Rights Over Personal Data<\/h3>\n

The DPDP Act gives individuals several rights, including the right to:<\/p>\n