DPDP reference

Section 40: Power to make rules

Last checked 6 Nov 2026

The Central Government may make rules, after previous publication, to carry out the Act (s.40(1)). s.40(2) lists the subjects, including notices, Consent Managers, breach intimation, children's consent, rights requests and grievance periods. The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) were made under this section.

Applies to
The Central Government.
Starts
13 Nov 2025, in force (G.S.R. 843(E), item (a)).
Penalty
None of its own. This section sets out how the law works and places no duty on a business.
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 40; G.S.R. 843(E), commencement

Questions

Which rules were made under the DPDP Act?

The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) of 13 Nov 2025, with corrigenda in G.S.R. 892(E) of 10 Dec 2025.

Related

Next

Join early access

Not legal advice.