India's DPDP Act: what it requires for cookies and consent

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) is India's first general data protection law. Parliament passed it in August 2023 and it received assent on 11 August 2023. It only became operational with the Digital Personal Data Protection Rules, 2025, published in the Gazette under G.S.R. 846(E) dated 13 November 2025 after a consultation that drew 6,915 comments. The Ministry of Electronics and Information Technology (MeitY) administers the law, and the Data Protection Board of India enforces it.

The Rules set three dates. Rules 1, 2 and 17 to 21, which create the Board and its procedures, came into force on publication. Rule 4, on registering consent managers, comes into force one year after publication, in November 2026. Rules 3 and 5 to 16, which contain the notice, security, breach, children and data retention duties, and Rules 22 and 23 come into force eighteen months after publication, in May 2027. A separate notification brought the Act's own sections into force on the same schedule. Until then, Section 43A of the Information Technology Act and its 2011 rules on sensitive personal data still apply.

Who does the DPDP Act apply to?

Section 3 applies the Act to the processing of digital personal data within India, whether collected digitally or digitized later, and to processing outside India in connection with offering goods or services to people in India. A foreign online shop or app that serves Indian customers is in scope. Unlike the GDPR, the Act does not extend to monitoring alone: a foreign site that profiles Indian visitors without offering them anything falls outside the text. Personal data processed for purely personal purposes and data made public by the person are excluded. The obligations fall on the Data Fiduciary, the entity that decides the purpose and means of processing; Significant Data Fiduciaries, designated by the government, have extra duties such as audits and impact assessments.

Do cookies need consent in India?

The Act does not mention cookies. It applies to them when they collect personal data, meaning data about an individual who is identifiable by or in relation to that data. The Act allows only two grounds for processing: consent, and the "certain legitimate uses" listed in Section 7, such as data the person voluntarily provides for a specified purpose, legal obligations, medical emergencies and employment. There is no legitimate interest basis. Analytics, advertising and cross-site tracking cookies therefore need consent once the core duties apply in May 2027.

Children get stronger protection. A child is anyone under 18. A Data Fiduciary must obtain verifiable consent from a parent before processing a child's personal data, and Section 9(3) prohibits tracking or behavioral monitoring of children and targeted advertising directed at them, subject to exemptions set by the Rules for specific classes and purposes, such as health services and education.

What must notice and consent look like?

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the personal data necessary for the specified purpose. Any part of a consent that infringes the Act is invalid. The request must be in clear and plain language, with the option to read it in English or one of the 22 languages of the Eighth Schedule to the Constitution, and must give a contact for questions. Withdrawal must be as easy as giving consent (Section 6(4)), and the Data Fiduciary must prove that notice was given and consent obtained (Section 6(10)).

Rule 3 describes the notice. It must be understandable on its own, separately from other information, and give at least an itemized description of the personal data and the specific purposes, plus a link to withdraw consent, exercise rights and complain to the Board. A consent banner that names each category of cookie, its purpose and a withdrawal link fits this description; a single "by using this site you agree" line does not.

What are consent managers?

The Act lets people give, manage, review and withdraw consent through a Consent Manager, a registered intermediary accountable to them (Section 6(7) to 6(9)). Under Rule 4 and the First Schedule, a consent manager must be a company incorporated in India with a net worth of at least ₹2 crore and must register with the Board. Registration opens in November 2026. Using a consent manager is an option for people, not a duty for websites.

How are transfers abroad regulated?

The Act uses a negative list. Section 16 lets the central government restrict, by notification, transfers to countries it names; transfers elsewhere are allowed. Rule 15 adds that a Data Fiduciary must meet any requirements the government sets by order for making personal data available to a foreign state or entities it controls. Sector laws with stricter localization rules, such as those of the Reserve Bank of India, continue to apply. No country had been restricted when this page was written.

Who enforces the Act, and what are the penalties?

The Data Protection Board inquires into breaches, mainly on complaint, and imposes penalties after a hearing; its decisions can be appealed to TDSAT. The Schedule sets maximum penalties per instance: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a personal data breach and for breaching the children's obligations, and up to ₹50 crore for other breaches of the Act or Rules. The Board considers the nature, gravity and duration of the breach when setting the amount. Since the core obligations apply from May 2027, there has been no penalty under the Act yet.

What should a website serving India do before May 2027?

• Inventory the cookies and tags that collect personal data; the cookie scanner gives a first list.
• Prepare an itemized consent notice per purpose, with withdrawal as easy as acceptance.
• Keep proof of each consent, since the burden of proof is on you.
• Check whether children use your service and stop behavioral tracking for them.

India is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add India to a custom list. Indian visitors then see the opt-in banner with Reject all, and the consent log records each choice as proof. See also Singapore and the Indonesian law.