India PDP Bill 2019 vs DPDP Act 2023: What Changed

The Personal Data Protection Bill, 2019 is no longer pending and never became law. The government withdrew it in August 2022. India's data protection law today is the Digital Personal Data Protection Act, 2023 (DPDP Act), brought into force in phases by the DPDP Rules, 2025. For current obligations, deadlines and penalties, read our DPDP Act guide.

This page is a short history of the PDP Bill and a side-by-side comparison of the PDP Bill 2019 vs the DPDP Act 2023, so you can see what changed and why older PDP Bill advice no longer applies.

What was the Personal Data Protection Bill 2019?

The Personal Data Protection Bill, 2019 (PDP Bill) was India's first attempt at a comprehensive, GDPR-style data protection law. It grew out of the Supreme Court's 2017 Puttaswamy judgment, which recognised privacy as a fundamental right, and the draft law prepared by a committee chaired by retired Justice B.N. Srikrishna.

The PDP Bill was long and ambitious. It split personal data into three tiers, proposed data localisation for sensitive and critical personal data, created a powerful Data Protection Authority of India, and set penalties linked to a company's worldwide turnover. It also introduced the idea of consent managers, which survived into the DPDP Act.

PDP Bill timeline: from draft to withdrawal

Date	Event
27 July 2018	The Srikrishna committee submits its report and the draft Personal Data Protection Bill, 2018 to the IT Ministry
11 December 2019	The Personal Data Protection Bill, 2019 is introduced in the Lok Sabha and later referred to a Joint Parliamentary Committee (JPC)
16 December 2021	The JPC report is tabled in Parliament; it renames the bill the Data Protection Bill, 2021 and proposes bringing non-personal data into scope
3 August 2022	The government withdraws the bill from the Lok Sabha, saying it will bring a new bill that fits a comprehensive legal framework
18 November 2022	MeitY publishes the draft Digital Personal Data Protection Bill, 2022 for public consultation
11 August 2023	The Digital Personal Data Protection Act, 2023 receives presidential assent and is published in the Gazette
13 November 2025	The DPDP Rules, 2025 are published, phasing in the Act through 13 May 2027

Why was the PDP Bill withdrawn?

The JPC deliberated for two years and proposed extensive amendments. Its version went beyond personal data: it brought non-personal data into the law, proposed a single regulator for both, and pushed further on data localisation. Commentators criticised how far the expanded scope went beyond data protection. Rather than amend the bill again, the government withdrew it in August 2022 and started over with a much shorter draft, which became the DPDP Act.

PDP Bill 2019 vs DPDP Act 2023: comparison

Topic	PDP Bill 2019 (withdrawn)	DPDP Act 2023 (in force in phases)
Status	Never enacted; withdrawn on 3 August 2022	Enacted on 11 August 2023; DPDP Rules published on 13 November 2025
Scope	Personal data, online and offline	Digital personal data only, including offline data that is later digitised
Data categories	Three tiers: personal data, sensitive personal data (such as financial, health and biometric data, caste, and religious or political beliefs) and critical personal data notified by the government	One category of personal data; no sensitive or critical tier, but extra duties for children's data and Significant Data Fiduciaries
Data localisation	Sensitive personal data had to be stored in India (transfers abroad for processing only with explicit consent and other conditions); critical personal data could be processed only in India	No general localisation requirement; stricter sector rules, such as RBI payment data rules, still apply
Cross-border transfers	Restricted for sensitive and critical personal data	Allowed to any country unless the government restricts it by notification
Non-personal data	The government could direct companies to share anonymised personal data or non-personal data; the JPC wanted non-personal data fully in scope	Out of scope
Regulator	Data Protection Authority of India, with a chairperson and six members, appeals to an Appellate Tribunal and then the Supreme Court	Data Protection Board of India, an adjudicating body set up by the central government; appeals go to TDSAT
Penalties	Up to ₹15 crore or 4% of worldwide turnover, whichever is higher, for serious breaches; ₹5 crore or 2% for others, such as failing to carry out a data audit	Fixed caps per breach, up to ₹250 crore for failing to take reasonable security safeguards
Consent managers	Introduced: consent managers registered with the Data Protection Authority	Retained: consent managers register with the Data Protection Board; registration opens 13 November 2026
Breach reporting	Report to the regulator only if a breach was likely to cause harm	Report every breach to the Board and to each affected individual
Data portability	Included	Not included

In short, the DPDP Act keeps the core of the PDP Bill (notice, consent, security, data rights and consent managers) but drops the data tiers, localisation and turnover-based fines. Do not use a PDP Bill checklist for compliance today: some of its obligations no longer exist, and the DPDP Act adds new ones, such as reporting every personal data breach.

What this means for your website now

If your website or app serves people in India, the law to plan for is the DPDP Act and DPDP Rules, not the PDP Bill. Consent Manager rules apply from 13 November 2026, and most obligations, including notice, consent, security safeguards, breach notification, children's data and data rights, apply from 13 May 2027.

In practice that means:

Show a clear, standalone notice in plain language before you collect personal data
Collect free, specific, informed and unambiguous consent, and make withdrawing it as easy as giving it
Keep records that prove when and how consent was given
Get verifiable parental consent before processing data of anyone under 18
Honour access, correction and erasure requests

Our DPDP Act guide covers each deadline, obligation and penalty in detail. UniConsent helps you show DPDP-ready consent notices, collect and log consent, and support multiple languages, alongside GDPR and other global privacy laws.

Sources

Frequently Asked Questions

Is the Personal Data Protection Bill 2019 still in force?

No. The PDP Bill 2019 never became law. The government withdrew it from the Lok Sabha on 3 August 2022. India’s data protection law is now the Digital Personal Data Protection Act, 2023, which the DPDP Rules, 2025 bring into force in phases.

Why was the PDP Bill withdrawn?

The Joint Parliamentary Committee’s December 2021 report proposed extensive changes, including renaming it the Data Protection Bill, 2021 and bringing non-personal data into scope. The government withdrew the bill in August 2022 to bring a new bill that fits a comprehensive legal framework.

What is the main difference between the PDP Bill and the DPDP Act?

The DPDP Act is shorter and simpler. It drops the sensitive and critical personal data categories and the data localisation rules, covers only digital personal data, replaces the proposed Data Protection Authority with an adjudicating Data Protection Board, allows transfers abroad unless a country is restricted, and sets fixed penalties of up to ₹250 crore instead of a share of worldwide turnover.

Do I need to comply with the PDP Bill 2019?

No. Websites and apps that serve people in India should prepare for the DPDP Act and DPDP Rules instead. Consent Manager rules apply from 13 November 2026, and most obligations, including notice, security safeguards, breach notification and data rights, apply from 13 May 2027.

Comply With Global Privacy Regulations

General Data Protection Regulation (GDPR)

Achieve seamless compliance with the General Data Protection Regulation (GDPR) – the cornerstone of data privacy in the European Union. Safeguard user data and build trust with our comprehensive GDPR compliance solutions.

California Consumer Privacy Act (CCPA)

Navigate the intricate landscape of the California Consumer Privacy Act (CCPA) effortlessly. Our CCPA compliance tools ensure that you adhere to the rigorous data protection standards required for California residents.

U.S. State Privacy Laws

Stay ahead of evolving privacy regulations in the United States. Our platform supports a range of state-specific laws, including CCPA, CPRA, CPA, VCDPA, UCPA, and COPPA, ensuring you remain compliant across all jurisdictions.

California Privacy Rights Act (CPRA)

Embrace the future of data privacy with the California Privacy Rights Act (CPRA). As a pioneering state-level legislation, CPRA empowers businesses to enhance their data protection practices and prioritize consumer privacy.

Colorado Privacy Act (CPA)

Prepare for the Colorado Privacy Act (CPA) with UniConsent CMP. Our solutions help you meet the stringent requirements of this forward-thinking state-level privacy law, ensuring the highest level of data security and compliance.

Virginia Consumer Data Protection Act (VCDPA)

Comply confidently with the Virginia Consumer Data Protection Act (VCDPA). UniConsent CMP provides the tools and expertise to ensure your organization aligns with VCDPA's robust data privacy framework, bolstering trust among Virginia residents.

Utah Consumer Privacy Act (UCPA)

Protect user data effectively with the Utah Consumer Privacy Act (UCPA). UniConsent CMP offers solutions that facilitate compliance with this emerging privacy law, ensuring your business is well-prepared for data privacy challenges in Utah.

Connecticut Data Protection Act (CTDPA)

Guard user information and uphold their privacy rights under the Connecticut Data Protection Act (CTDPA). UniConsent CMP's suite of compliance tools empowers you to navigate this state-level law seamlessly and responsibly.

Children’s Online Privacy Protection Act (COPPA)

Prioritize children's privacy with UniConsent CMP's COPPA compliance solutions. Complying with the Children’s Online Privacy Protection Act (COPPA) is simplified, allowing you to provide a safe online environment for young users.

General Data Protection in Thailand (PDPA)

Adhere to the Personal Data Protection Act 2019 (PDPA) in Thailand with UniConsent CMP. Our expertise in PDPA compliance ensures that your organization can operate confidently and securely in the Thai market while respecting user data privacy.

The General Data Protection Law in Brazil (LGPD)

UniConsent CMP facilitates compliance with Brazil's General Data Protection Law (LGPD). Our solutions empower businesses to meet LGPD's stringent requirements, safeguarding the personal data of individuals in Brazil.

China Personal Information Protection Law (PIPL)

Prepare for the China Personal Information Protection Law (PIPL) with UniConsent CMP. As data protection regulations evolve in China, our platform ensures your organization is well-equipped to handle personal information responsibly and securely.

Protection of Personal Information Act in South Africa (POPIA)

The Summary of Protection of Personal Information Act, POPI Act, POPIA, South African Privacy Law.

India’s Personal Data Protection (PDP)

The Personal Data Protection bill for India could require changes to your data management and is not directly solved with GDPR compliance.

Turkey Personal Data Protection Law (KVKK)

The Summary of Turkey’s Personal Data Protection Law: KVKK.

UK General Data Protection Regulation (UK GDPR)

Achieve seamless compliance with the General Data Protection Regulation (GDPR) – the cornerstone of data privacy in the UK. Safeguard user data and build trust with our comprehensive GDPR compliance solutions.

Texas Data Privacy and Security Act (TDPSA)

Comply with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024. UniConsent CMP supports opt-out rights, universal opt-out signals, and data protection assessments for Texas residents.

Delaware Personal Data Privacy Act (DPDPA)

Meet the requirements of the Delaware Personal Data Privacy Act (DPDPA). UniConsent CMP provides opt-out and opt-in consent tools, consumer rights management, and sensitive data workflows for Delaware compliance.

New Hampshire Privacy Act (NHPA)

Comply with the New Hampshire Privacy Act (NHPA). UniConsent CMP provides consent banners, Global Privacy Control support, and consumer rights request management for New Hampshire residents.

Montana Consumer Data Privacy Act (MTCDPA)

Meet the requirements of the Montana Consumer Data Privacy Act (MTCDPA). UniConsent CMP helps businesses manage opt-out rights, sensitive data consent, and consumer requests for Montana residents.

Florida Digital Bill of Rights (FDBR)

Meet the requirements of the Florida Digital Bill of Rights (FDBR). UniConsent CMP provides opt-out consent tools, children's data protections, and consumer rights management for Florida compliance.

New Jersey Data Protection Act (NJDPA)

Comply with the New Jersey Data Protection Act (NJDPA). UniConsent CMP provides opt-out consent banners, Global Privacy Control signal recognition, and consumer rights request management for New Jersey residents.

Indiana Consumer Data Protection Act (INCDPA)

Meet the requirements of the Indiana Consumer Data Protection Act (INCDPA). UniConsent CMP provides opt-out consent tools, sensitive data workflows, and consumer rights management for Indiana residents.

Iowa Consumer Data Protection Act (ICDPA)

Comply with the Iowa Consumer Data Protection Act (ICDPA). UniConsent CMP provides opt-out consent banners and consumer rights request management for Iowa residents.

Maryland Online Data Privacy Act (MODPA)

Meet the strict requirements of the Maryland Online Data Privacy Act (MODPA). UniConsent CMP supports data minimization, opt-in consent for sensitive data, and consumer rights management for Maryland residents.

Minnesota Consumer Data Privacy Act (MNCDPA)

Comply with the Minnesota Consumer Data Privacy Act (MNCDPA). UniConsent CMP provides opt-out consent tools, sensitive data workflows, and consumer rights management for Minnesota residents.

Nebraska Data Privacy Act (NDPA)

Meet the requirements of the Nebraska Data Privacy Act (NDPA). UniConsent CMP provides opt-out and opt-in consent tools, Global Privacy Control support, and consumer rights management for Nebraska residents.

Oregon Consumer Privacy Act (OCPA)

Comply with the Oregon Consumer Privacy Act (OCPA). UniConsent CMP provides opt-out consent banners, sensitive data opt-in workflows, and consumer rights management for Oregon residents.

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

Meet the requirements of the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA). UniConsent CMP provides consent banners, Global Privacy Control support, and consumer rights management for Rhode Island residents.

Tennessee Information Protection Act (TIPA)

Comply with the Tennessee Information Protection Act (TIPA). UniConsent CMP provides opt-out consent tools, sensitive data workflows, and NIST Privacy Framework-aligned privacy management for Tennessee residents.

Oklahoma Computer Data Privacy Act (OKCDPA)

Meet the requirements of the Oklahoma Computer Data Privacy Act (OKCDPA). UniConsent CMP provides opt-out consent banners, sensitive data consent workflows, and consumer rights management for Oklahoma residents.

Nevada Privacy Law (NRS 603A)

Comply with Nevada privacy law (NRS 603A). UniConsent CMP supports opt-out of data sale rights and consent management for Nevada residents.

California Invasion of Privacy Act (CIPA)

Manage CIPA compliance for your website. UniConsent CMP provides opt-in consent tools that block third-party tracking scripts until consent is granted, supporting compliance with California wiretapping law.

California Delete Act (SB 362)

Comply with the California Delete Act (SB 362). UniConsent CMP helps businesses manage consumer deletion requests, data broker obligations, and opt-out preference signals.

Kentucky Consumer Data Protection Act (KCDPA)

Meet the requirements of the Kentucky Consumer Data Protection Act (KCDPA). UniConsent CMP provides opt-out consent tools, sensitive data workflows, and consumer rights management for Kentucky residents.

Alabama Personal Data Protection Act (APDPA)

Prepare for the Alabama Personal Data Protection Act (APDPA), effective May 1, 2027. UniConsent CMP provides opt-out and opt-in consent tools, sensitive data workflows, and consumer rights management for Alabama residents.

Washington My Health My Data Act (MHMDA)

Comply with Washington's My Health My Data Act (MHMDA). UniConsent CMP provides separate opt-in consents to collect and to share consumer health data, IAB GPP sensitive data signals and consent records.

American Privacy Rights Act (APRA)

Track the proposed American Privacy Rights Act (APRA), a federal privacy bill that would set one national standard. UniConsent CMP covers its opt-out, consent and universal opt-out signal requirements.

Massachusetts Information Privacy Act (MIPA)

Prepare for the proposed Massachusetts Information Privacy Act (MIPA). UniConsent CMP provides consent banners, Global Privacy Control support and consumer rights management for Massachusetts residents.

Vietnam Personal Data Protection Law (PDPL)

Comply with Vietnam's Law on Personal Data Protection (PDPL), Law No. 91/2025/QH15, effective January 1, 2026. UniConsent CMP provides consent collection, preference management, and consent record storage to meet Vietnam's consent-centric requirements.