Deepfakes are media created using artificial intelligence in which people are seen to be saying or doing things they did not. Deepfakes can be used for various harmful purposes, so it is necessary to analyse how the law can regulate them. Today, there are several instances of deepfakes being misused both in the Indian and global context. This article suggests how India's first comprehensive data protection law, the Digital Personal Data Protection Act, 2023, can regulate deepfakes. The article proposes that data fiduciaries who create and circulate deepfakes must comply with data protection obligations, and data principals whose deepfakes are circulated must have rights against non-consensual use of deepfakes.