DPDP reference
The DPDP Act and Rules, section by section
Each page gives the provision in plain words, who it applies to, when it starts, the penalty and a link to the official text.
Digital Personal Data Protection Act, 2023
- Section 1: Short title and commencement
- Section 2: Definitions
- Section 3: Application of the Act
- Section 4: Grounds for processing personal data
- Section 5: Notice
- Section 6: Consent
- Section 7: Certain legitimate uses
- Section 8: General obligations of Data Fiduciary
- Section 9: Processing of personal data of children
- Section 10: Additional obligations of Significant Data Fiduciary
- Section 11: Right to access information about personal data
- Section 12: Right to correction and erasure of personal data
- Section 13: Right of grievance redressal
- Section 14: Right to nominate
- Section 15: Duties of Data Principal
- Section 16: Processing of personal data outside India
- Section 17: Exemptions
- Section 18: Establishment of Board
- Section 19: Composition and qualifications of the Board
- Section 20: Salary, allowances and term of office
- Section 21: Disqualifications for Chairperson and Members
- Section 22: Resignation and filling of vacancy
- Section 23: Proceedings of Board
- Section 24: Officers and employees of Board
- Section 25: Members and officers to be public servants
- Section 26: Powers of Chairperson
- Section 27: Powers and functions of Board
- Section 28: Procedure to be followed by Board
- Section 29: Appeal to Appellate Tribunal
- Section 30: Orders passed by Appellate Tribunal
- Section 31: Alternate dispute resolution
- Section 32: Voluntary undertaking
- Section 33: Penalties
- Section 34: Crediting sums realised by way of penalties
- Section 35: Protection of action taken in good faith
- Section 36: Power to call for information
- Section 37: Power of Central Government to issue directions
- Section 38: Consistency with other laws
- Section 39: Bar of jurisdiction
- Section 40: Power to make rules
- Section 41: Laying of rules and certain notifications
- Section 42: Power to amend Schedule
- Section 43: Power to remove difficulties
- Section 44: Amendments to certain Acts
Digital Personal Data Protection Rules, 2025
- Rule 1: Short title and commencement
- Rule 2: Definitions
- Rule 3: Notice given by Data Fiduciary to Data Principal
- Rule 4: Registration and obligations of Consent Manager
- Rule 5: Processing for subsidies, benefits, services, certificates, licences and permits
- Rule 6: Reasonable security safeguards
- Rule 7: Intimation of personal data breach
- Rule 8: Time period for specified purpose to be deemed as no longer being served
- Rule 9: Contact information of person to answer questions about processing
- Rule 10: Verifiable consent for processing of personal data of child
- Rule 11: Verifiable consent for person with disability who has lawful guardian
- Rule 12: Exemptions for processing of personal data of child
- Rule 13: Additional obligations of Significant Data Fiduciary
- Rule 14: Rights of Data Principals
- Rule 15: Transfer of personal data outside the territory of India
- Rule 16: Exemption from Act for research, archiving or statistical purposes
- Rule 17: Appointment of Chairperson and other Members
- Rule 18: Salary, allowances and terms of Chairperson and Members
- Rule 19: Procedure for meetings of Board and authentication of orders
- Rule 20: Functioning of Board as digital office
- Rule 21: Terms of appointment and service of Board officers and employees
- Rule 22: Appeal to Appellate Tribunal
- Rule 23: Calling for information from Data Fiduciary or intermediary
Not legal advice.