Data Privacy · Reference
The DPDP Act & Rules, section by section
Every provision of the DPDP Act 2023 and the DPDP Rules 2025, one plain-English line each, with its current status. Use it as a map — follow a link into a topic guide for the detail.
Educational only · not legal adviceReviewed by Sandesh Kokate, Editor
The Act has 9 chapters and 44 sections plus a penalty Schedule; the Rules have 23 rules and 7 schedules. Most core obligations are on the statute book now but become enforceable on 13 May 2027, and the Data Protection Board is not yet hearing complaints.
Digital Personal Data Protection Act, 2023
| Provision | What it covers | Status |
|---|---|---|
| Chapter I — Preliminary | ||
| Section 1 | Short title & commencementNames the Act and lets the government switch on different parts on different dates. | In Force |
| Section 2 | DefinitionsThe vocabulary — Data Fiduciary, Data Principal, consent, personal data, breach. | In Force |
| Section 3 | Application of ActWho's covered: processing in India, and foreign firms serving Indian users; personal and published data are excluded. | Enforceable |
| Chapter II — Obligations of Data Fiduciary | ||
| Section 4 | Grounds for processingYou may process personal data only with consent, or for a recognised legitimate use. | Enforceable |
| Section 5 | NoticeBefore consent, tell people what data you take, why, and how to exercise rights or complain. | Enforceable |
| Section 6 | ConsentConsent must be free, specific, informed, unambiguous — and as easy to withdraw as to give. | Enforceable |
| Section 7 | Certain legitimate usesProcessing without fresh consent: voluntary sharing, state benefits, medical emergencies, employment. | Enforceable |
| Section 8 | General obligations of Data FiduciaryCore duties — accuracy, security, breach reporting, erasure, a grievance route — even when a processor slips. | Enforceable |
| Section 9 | Processing of children's dataUnder-18s need verifiable parental consent; no behavioural tracking or targeted ads at children. | Enforceable |
| Section 10 | Significant Data FiduciaryExtra duties — DPO, independent audit, DPIA — for high-volume or high-risk players the government names. | Enforceable |
| Chapter III — Rights & Duties of Data Principal | ||
| Section 11 | Right to access informationAsk what data a fiduciary holds on you, and who it was shared with. | Enforceable |
| Section 12 | Right to correction & erasureGet your data corrected, completed, updated, or deleted. | Enforceable |
| Section 13 | Right of grievance redressalA working complaint channel you must use before escalating to the Board. | Enforceable |
| Section 14 | Right to nominateName someone to exercise your rights if you die or become incapacitated. | Enforceable |
| Section 15 | Duties of Data PrincipalDon't impersonate, don't file false complaints, and give authentic information. | Enforceable |
| Chapter IV — Special Provisions | ||
| Section 16 | Processing outside IndiaCross-border transfers are allowed unless the government restricts a destination country. | Enforceable |
| Section 17 | ExemptionsCarve-outs — legal claims, court functions, crime investigation, research, and a startup relaxation. | Enforceable |
| Chapter V — Data Protection Board of India | ||
| Section 18 | Establishment of BoardCreates the Data Protection Board of India. | In Force |
| Section 19 | Composition & qualificationsWho sits on the Board and the expertise they must have. | In Force |
| Section 20 | Salary, allowances & termPay and a two-year term for the Chairperson and Members. | In Force |
| Section 21 | DisqualificationsGrounds that bar someone from serving on the Board. | In Force |
| Section 22 | Resignation & vacanciesHow Members leave and how vacancies are filled. | In Force |
| Section 23 | Proceedings of BoardHow the Board runs meetings and authenticates its orders. | In Force |
| Section 24 | Officers & employeesThe Board may hire the staff it needs. | In Force |
| Section 25 | Members to be public servantsBoard people count as public servants when acting under the Act. | In Force |
| Section 26 | Powers of ChairpersonThe Chairperson's administrative and case-allocation powers. | In Force |
| Chapter VI — Powers, Functions & Procedure of Board | ||
| Section 27 | Powers & functions of BoardWhat the Board can do — inquire into breaches and impose penalties. | Enforceable |
| Section 28 | Procedure to be followedHow inquiries run: a digital office with civil-court-like powers. | Enforceable |
| Chapter VII — Appeal & Alternate Dispute Resolution | ||
| Section 29 | Appeal to Appellate TribunalAppeal Board orders to the TDSAT within 60 days. | Enforceable |
| Section 30 | Orders executable as decreeTribunal orders enforce like a civil-court decree. | Enforceable |
| Section 31 | Alternate dispute resolutionThe Board can refer a dispute to mediation. | Enforceable |
| Section 32 | Voluntary undertakingYou can offer binding commitments to settle a matter. | Enforceable |
| Chapter VIII — Penalties & Adjudication | ||
| Section 33 | PenaltiesHow the Board sets a monetary penalty and what it weighs. | Enforceable |
| Section 34 | Penalties to Consolidated FundFines collected are paid into the Consolidated Fund of India. | Enforceable |
| Chapter IX — Miscellaneous | ||
| Section 35 | Protection for good-faith actsNo suits against the government or Board for things done in good faith. | In Force |
| Section 36 | Power to call for informationGovernment may require information from the Board or fiduciaries. | Enforceable |
| Section 37 | Power to issue directionsAfter repeat penalties, government can order public access to a service blocked. | Enforceable |
| Section 38 | Consistency with other lawsThis Act adds to other laws and prevails where they conflict. | In Force |
| Section 39 | Bar of jurisdictionCivil courts can't hear matters the Board is empowered to handle. | In Force |
| Section 40 | Power to make rulesLets the government issue the DPDP Rules. | In Force |
| Section 41 | Laying of rulesRules and certain notifications must go before Parliament. | In Force |
| Section 42 | Power to amend ScheduleGovernment can adjust penalty amounts, capped at doubling. | In Force |
| Section 43 | Power to remove difficultiesGovernment can smooth teething problems for three years. | In Force |
| Section 44 | Amendments to certain ActsConsequential edits to the TRAI Act, the IT Act, and the RTI Act. | In Force |
| The Schedule | Monetary penaltiesThe penalty table — seven items, from ₹10,000 to ₹250 crore. | Enforceable |
Digital Personal Data Protection Rules, 2025
| Provision | What it covers | Status |
|---|---|---|
| Rule 1 | Short title & commencementNames the Rules and sets the phased start dates. | In Force |
| Rule 2 | DefinitionsRule-specific terms like 'user account' and 'verifiable consent'. | In Force |
| Rule 3 | Notice by Data FiduciaryA notice must stand alone, itemise data and purpose, and link to withdraw consent, exercise rights, and complain. | Enforceable |
| Rule 4 | Consent Manager registrationHow a consent-management intermediary registers with the Board, and its duties. | Notified |
| Rule 5 | Processing for State benefitsStandards for how the State processes data to deliver subsidies, benefits, and licences. | Enforceable |
| Rule 6 | Reasonable security safeguardsMinimum security — encryption, access control, a year of logs, backups, processor contracts. | Enforceable |
| Rule 7 | Breach intimationTell affected people without delay; tell the Board without delay, and in full within 72 hours. | Enforceable |
| Rule 8 | Retention & erasureBig e-commerce, gaming and social platforms erase after 3 years of inactivity, with 48-hour warning. | Enforceable |
| Rule 9 | Contact informationPublish who answers questions about your processing — a DPO or a named responder. | Enforceable |
| Rule 10 | Verifiable consent — childVerify that a parent is an identifiable adult before processing a child's data. | Enforceable |
| Rule 11 | Verifiable consent — disabilityVerify a lawful guardian before processing data of a person with disability. | Enforceable |
| Rule 12 | Children — exemptionsHealth, education and safety uses are exempt from parts of the children's-data rule. | Enforceable |
| Rule 13 | SDF additional obligationsAnnual DPIA and audit, algorithm checks, and any data-localisation order. | Enforceable |
| Rule 14 | Rights of Data PrincipalsPublish how to exercise rights, with a grievance system that responds within 90 days. | Enforceable |
| Rule 15 | Transfer outside IndiaCross-border transfer is allowed, subject to any Central Government order. | Enforceable |
| Rule 16 | Research/archiving exemptionThe Act steps back for genuine research, archiving or statistics if standards are met. | Enforceable |
| Rule 17 | Appointment of Chairperson/MembersA Search-cum-Selection Committee recommends who is appointed. | In Force |
| Rule 18 | Salary & terms of MembersBoard pay and service conditions. | In Force |
| Rule 19 | Board meetingsMeeting procedure; inquiries to finish within six months. | In Force |
| Rule 20 | Board as digital officeThe Board runs digitally, without needing anyone physically present. | In Force |
| Rule 21 | Officers & employees termsService terms for Board staff. | In Force |
| Rule 22 | Appeal to TribunalAppeals are filed digitally, with a fee like TRAI appeals. | Enforceable |
| Rule 23 | Calling for informationGovernment may require information for the purposes in the Seventh Schedule. | Enforceable |
| First Schedule | Consent Manager conditionsConditions to register (Part A) and obligations (Part B) of a Consent Manager. | Notified |
| Second Schedule | Processing standardsStandards for State processing and for research, archiving and statistics. | Enforceable |
| Third Schedule | Retention periodsThree-year retention for large e-commerce (2cr), gaming (50L) and social media (2cr). | Enforceable |
| Fourth Schedule | Children's-data exemptionsThe exempt classes (health, education, transport) and purposes for children's data. | Enforceable |
| Fifth Schedule | Service terms — MembersSalary levels and service terms for the Chairperson and Members. | In Force |
| Sixth Schedule | Service terms — staffAppointment and service terms for Board officers and employees. | In Force |
| Seventh Schedule | Authorised-person tableWhich authority may call for information, and for which purpose. | Enforceable |
Source
MeitY — DPDP Act (Gazette PDF)Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023).
Status unverified — no status check recorded
Source
MeitY — DPDP Rules, 2025 (Gazette PDF)Cited on this page as G.S.R. 846(E), notified 13 November 2025 (Gazette ID CG-DL-E-14112025-267650).
Status unverified — no status check recorded
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.