Administered by the Data Protection Board of India, it requires consent-based data processing, mandates breach notification, and allows penalties up to ₹250 crore for significant violations. It's India's rough analogue to the EU's GDPR, and matters for any AI company training on or serving Indian user data — separate from and less prescriptive than the EU AI Act's capability-based risk tiers.