India AI RulebookData Privacy · Reference
The DPDP Act & Rules, section by section
Every provision of the DPDP Act 2023 and the DPDP Rules 2025, one plain-English line each, with its current status. Use it as a map — follow a link into a topic guide for the detail.
Last updated: 17 August 2026Written and edited by Sandesh Kokate
Checked against primary sources where marked. Items marked Confirmation pending are not yet checked. See the list
The Act has 9 chapters and 44 sections plus a penalty Schedule; the Rules have 23 rules and 7 schedules. Most core obligations are on the statute book now but become enforceable on the main-duty planning date, and the Data Protection Board is not yet hearing complaints.
Digital Personal Data Protection Act, 2023
| Provision | What it covers | Status |
|---|---|---|
| Chapter I — Preliminary | ||
| Section 1 | Short title & commencementNames the Act and lets the government switch on different parts on different dates. | In Force |
| Section 2 | DefinitionsThe vocabulary — Data Fiduciary, Data Principal, consent, personal data, breach. | In Force |
| Section 3 | Application of ActWho's covered: processing in India, and foreign firms serving Indian users; personal and published data are excluded. | Enforceable |
| Chapter II — Obligations of Data Fiduciary | ||
| Section 4 | Grounds for processingYou may process personal data only with consent, or for a recognised legitimate use. | Enforceable |
| Section 5 | NoticeBefore consent, tell people what data you take, why, and how to exercise rights or complain. | Enforceable |
| Section 6 | ConsentConsent must be free, specific, informed, unambiguous — and as easy to withdraw as to give. | Enforceable |
| Section 7 | Certain legitimate usesProcessing without fresh consent: voluntary sharing, state benefits, medical emergencies, employment. | Enforceable |
| Section 8 | General obligations of Data FiduciaryCore duties — accuracy, security, breach reporting, erasure, a grievance route — even when a processor slips. | Enforceable |
| Section 9 | Processing of children's dataUnder-18s need verifiable parental consent; no behavioural tracking or targeted ads at children. | Enforceable |
| Section 10 | Significant Data FiduciaryExtra duties — DPO, independent audit, DPIA — for high-volume or high-risk players the government names. | Enforceable |
| Chapter III — Rights & Duties of Data Principal | ||
| Section 11 | Right to access informationAsk what data a fiduciary holds on you, and who it was shared with. | Enforceable |
| Section 12 | Right to correction & erasureGet your data corrected, completed, updated, or deleted. | Enforceable |
| Section 13 | Right of grievance redressalA working complaint channel you must use before escalating to the Board. | Enforceable |
| Section 14 | Right to nominateName someone to exercise your rights if you die or become incapacitated. | Enforceable |
| Section 15 | Duties of Data PrincipalDon't impersonate, don't file false complaints, and give authentic information. | Enforceable |
| Chapter IV — Special Provisions | ||
| Section 16 | Processing outside IndiaCross-border transfers are allowed unless the government restricts a destination country. | Enforceable |
| Section 17 | ExemptionsCarve-outs — legal claims, court functions, crime investigation, research, and a startup relaxation. | Enforceable |
| Chapter V — Data Protection Board of India | ||
| Section 18 | Establishment of BoardCreates the Data Protection Board of India. | In Force |
| Section 19 | Composition & qualificationsWho sits on the Board and the expertise they must have. | In Force |
| Section 20 | Salary, allowances & termPay and a two-year term for the Chairperson and Members. | In Force |
| Section 21 | DisqualificationsGrounds that bar someone from serving on the Board. | In Force |
| Section 22 | Resignation & vacanciesHow Members leave and how vacancies are filled. | In Force |
| Section 23 | Proceedings of BoardHow the Board runs meetings and authenticates its orders. | In Force |
| Section 24 | Officers & employeesThe Board may hire the staff it needs. | In Force |
| Section 25 | Members to be public servantsBoard people count as public servants when acting under the Act. | In Force |
| Section 26 | Powers of ChairpersonThe Chairperson's administrative and case-allocation powers. | In Force |
| Chapter VI — Powers, Functions & Procedure of Board | ||
| Section 27 | Powers & functions of BoardWhat the Board can do — inquire into breaches and impose penalties. | Enforceable |
| Section 28 | Procedure to be followedHow inquiries run: a digital office with civil-court-like powers. | Enforceable |
| Chapter VII — Appeal & Alternate Dispute Resolution | ||
| Section 29 | Appeal to Appellate TribunalAppeal Board orders to the TDSAT within 60 days. | Enforceable |
| Section 30 | Orders executable as decreeTribunal orders enforce like a civil-court decree. | Enforceable |
| Section 31 | Alternate dispute resolutionThe Board can refer a dispute to mediation. | Enforceable |
| Section 32 | Voluntary undertakingYou can offer binding commitments to settle a matter. | Enforceable |
| Chapter VIII — Penalties & Adjudication | ||
| Section 33 | PenaltiesHow the Board sets a monetary penalty and what it weighs. | Enforceable |
| Section 34 | Penalties to Consolidated FundFines collected are paid into the Consolidated Fund of India. | Enforceable |
| Chapter IX — Miscellaneous | ||
| Section 35 | Protection for good-faith actsNo suits against the government or Board for things done in good faith. | In Force |
| Section 36 | Power to call for informationGovernment may require information from the Board or fiduciaries. | Enforceable |
| Section 37 | Power to issue directionsAfter repeat penalties, government can order public access to a service blocked. | Enforceable |
| Section 38 | Consistency with other lawsThis Act adds to other laws and prevails where they conflict. | In Force |
| Section 39 | Bar of jurisdictionCivil courts can't hear matters the Board is empowered to handle. | In Force |
| Section 40 | Power to make rulesLets the government issue the DPDP Rules. | In Force |
| Section 41 | Laying of rulesRules and certain notifications must go before Parliament. | In Force |
| Section 42 | Power to amend ScheduleGovernment can adjust penalty amounts, capped at doubling. | In Force |
| Section 43 | Power to remove difficultiess.43(1): orders must be consistent with the Act. s.43(2): three-year limit from commencement. s.43(3): lay each order before both Houses. MeitY Act PDF p.19. | In Force |
| Section 44 | Amendments to certain ActsConsequential edits to the TRAI Act, the IT Act, and the RTI Act. | In Force |
| The Schedule | Monetary penaltiesThe penalty table — seven items, from ₹10,000 to ₹250 crore. | Enforceable |
Digital Personal Data Protection Rules, 2025
| Provision | What it covers | Status |
|---|---|---|
| Rule 1 | Short title & commencementNames the Rules and sets the phased start dates. | In Force |
| Rule 2 | DefinitionsRule-specific terms like 'user account' and 'verifiable consent'. | In Force |
| Rule 3 | Notice by Data FiduciaryA notice must stand alone, itemise data and purpose, and link to withdraw consent, exercise rights, and complain. | Enforceable |
| Rule 4 | Consent Manager registrationHow a consent-management intermediary registers with the Board, and its duties. | Notified |
| Rule 5 | Processing for State benefitsStandards for how the State processes data to deliver subsidies, benefits, and licences. | Enforceable |
| Rule 6 | Reasonable security safeguardsMinimum security — encryption, access control, a year of logs, backups, processor contracts. | Enforceable |
| Rule 7 | Breach intimationTell affected people without delay; tell the Board without delay, and in full within 72 hours. | Enforceable |
| Rule 8 | Retention & erasureBig e-commerce, gaming and social platforms erase after 3 years of inactivity, with 48-hour warning. | Enforceable |
| Rule 9 | Contact informationPublish who answers questions about your processing — a DPO or a named responder. | Enforceable |
| Rule 10 | Verifiable consent — childVerify that a parent is an identifiable adult before processing a child's data. | Enforceable |
| Rule 11 | Verifiable consent — disabilityVerify a lawful guardian before processing data of a person with disability. | Enforceable |
| Rule 12 | Children — exemptionsHealth, education and safety uses are exempt from parts of the children's-data rule. | Enforceable |
| Rule 13 | SDF additional obligationsAnnual DPIA and audit, algorithm checks, and any data-localisation order. | Enforceable |
| Rule 14 | Rights of Data PrincipalsPublish how to exercise rights, with a grievance system that responds within 90 days. | Enforceable |
| Rule 15 | Transfer outside IndiaCross-border transfer is allowed, subject to any Central Government order. | Enforceable |
| Rule 16 | Research/archiving exemptionThe Act steps back for genuine research, archiving or statistics if standards are met. | Enforceable |
| Rule 17 | Appointment of Chairperson/MembersA Search-cum-Selection Committee recommends who is appointed. | In Force |
| Rule 18 | Salary & terms of MembersBoard pay and service conditions. | In Force |
| Rule 19 | Board meetingsMeeting procedure; inquiries to finish within six months. | In Force |
| Rule 20 | Board as digital officeThe Board runs digitally, without needing anyone physically present. | In Force |
| Rule 21 | Officers & employees termsService terms for Board staff. | In Force |
| Rule 22 | Appeal to TribunalAppeals are filed digitally, with a fee like TRAI appeals. | Enforceable |
| Rule 23 | Calling for informationGovernment may require information for the purposes in the Seventh Schedule. | Enforceable |
| First Schedule | Consent Manager conditionsConditions to register (Part A) and obligations (Part B) of a Consent Manager. | Notified |
| Second Schedule | Processing standardsStandards for State processing and for research, archiving and statistics. | Enforceable |
| Third Schedule | Retention periodsThree-year retention for large e-commerce (2cr), gaming (50L) and social media (2cr). | Enforceable |
| Fourth Schedule | Children's-data exemptionsThe exempt classes (health, education, transport) and purposes for children's data. | Enforceable |
| Fifth Schedule | Service terms — MembersSalary levels and service terms for the Chairperson and Members. | In Force |
| Sixth Schedule | Service terms — staffAppointment and service terms for Board officers and employees. | In Force |
| Seventh Schedule | Authorised-person tableWhich authority may call for information, and for which purpose. | Enforceable |
Source
MeitY — DPDP Act (Gazette PDF)Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).
We opened this on 2026-11-01
Source
MeitY — DPDP Rules, 2025 (Gazette PDF)Cited on this page as G.S.R. 846(E), notified 13 November 2025 (Gazette ID CG-DL-E-14112025-267650).
We opened this on 2026-11-01