Digital Personal Data Protection Act (DPDP Act 2023)

1. Overview

This law’s purpose is to safeguard individuals’ personal data on the web and make sure that it is processed securely. It gives individuals control of their data and gives businesses and organisations a clear policy on how to gather, use, and store it. This legislation keeps individuals safe from deepfakes and other vicious online tools that are used to disseminate false or fake content in the contemporary world, which can abuse individual information such as voices, faces, or videos. This keeps individual data from being utilized to generate false or misleading content without consent.

2. Scope of the Act

Although the Act grants exceptions for some uses, such as research, litigation, and specific government activities, satire or parody is not generally exempt unless it is apparent that it is not intended to be an accurate representation of the object. This Act governs digital personal data processing, especially when explicit consent was not given.

Unauthorized deepfakes production could be considered a violation, particularly in cases of impersonation or non-consensual pornography, since it processes and distributes personal data. 

3. Important Clauses 

Prohibited Acts: Section 4 forbids processing personal data except for a lawful purpose,for which the Data Principal is given or seems to have given permission .

Consent Requirements: Clear, informed, and voluntary consent is required by Section 6. Deepfakes based on distinguishable characteristics require the individual’s consent.

Platform Responsibilities: Platforms must respond to  user complaints  and remove  personal data upon request (Section 12) and handle. They may also  be required  to reply to  takedown requests for deepfakes.

The DPDP Act regulates personal data processing and protects individuals from unauthorized use, including deepfakes. It requires consent for using personal data like Likeness or Voice in AI-generated content. Platforms and creators must ensure lawful processing, and individuals can seek to rectify harm caused by deepfakes.

4. Enforcement & Penalties 

Under Schedule I, violations can result in fines up to ₹250 crore or about $30 million. The  Indian Data Protection Board   upholds the law and has the power to look into the case and impose sanctions. Although criminal provisions are few, they may intersect sections of the  IT Act or the IPC.

5. Notable Cases or Precedents

There have been no significant  DPDP act rulings on deepfakes as of early 2025. Nonetheless, several complaints about AI-generated impersonation on social media are being investigated.

6. Comparison to Global Standards

The Indian DPDPA addresses the misuse of deepfakes through its more comprehensive framework governing the processing of personal data and consent requirements, whereas the EU’s AI Act specifically targets synthetic content with specific regulations. The potential financial penalties under the DPDPA are substantial and may be regarded as more severe than those found in many US state laws, which frequently have more specific but possibly less severe penalties for particular kinds of misuse.

7. Practical Implications

 Real identities should not be used by creators without permission. The Data Protection Board accepts complaints from victims. Platforms should set up procedures for takedown and grievance redress.

8. Future Scope

In the forthcoming years, the regulatory framework for AI content in India will develop even more. Future updates to the DPDPA may lead to even more targeted provisions to directly regulate deepfakes and other manipulated media. Furthermore, debates surrounding a proposed national AI policy raise the prospect of even stricter restrictions on specific types of AI-enabled impersonation. This project demonstrates India’s dedication to updating its legal system to meet the quickly developing capabilities of artificial intelligence and to guarantee the responsible and moral development and application of such potent technologies.