{ "site": "https://dpdpr.in", "generated": "2026-11-02T01:10:01+05:30", "disclaimer": "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY. Official text as notified; printed dashes shown as colons.", "act": "Digital Personal Data Protection Act, 2023 (No. 22 of 2023)", "source": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "chapters": [ { "num": "I", "title": "Preliminary", "sections": [ 1, 2, 3 ] }, { "num": "II", "title": "Obligations of Data Fiduciary", "sections": [ 4, 5, 6, 7, 8, 9, 10 ] }, { "num": "III", "title": "Rights and Duties of Data Principal", "sections": [ 11, 12, 13, 14, 15 ] }, { "num": "IV", "title": "Special Provisions", "sections": [ 16, 17 ] }, { "num": "V", "title": "Data Protection Board of India", "sections": [ 18, 19, 20, 21, 22, 23, 24, 25, 26 ] }, { "num": "VI", "title": "Powers, Functions and Procedure to Be Followed by Board", "sections": [ 27, 28 ] }, { "num": "VII", "title": "Appeal and Alternate Dispute Resolution", "sections": [ 29, 30, 31, 32 ] }, { "num": "VIII", "title": "Penalties and Adjudication", "sections": [ 33, 34 ] }, { "num": "IX", "title": "Miscellaneous", "sections": [ 35, 36, 37, 38, 39, 40, 41, 42, 43, 44 ] } ], "sections": [ { "section": 1, "title": "Short title and commencement", "chapter": "I", "chapter_title": "Preliminary", "url": "https://dpdpr.in/act/section-1/", "markdown": "https://dpdpr.in/act/section-1/index.md", "in_simple_words": "This section gives the law its name: the Digital Personal Data Protection Act, 2023. It also lets the Central Government start different parts of the law on different dates by notification.", "for_individuals": "The law did not start all at once. Check the start date of the part you care about.", "for_businesses": "Your obligations start on the dates notified by the Government. Most duties start on 13 May 2027.", "example": "The rules on setting up the Data Protection Board started on 13 November 2025, but the rules on consent notices start later.", "applies_to": "Everyone reading the Act; it sets the name and the start dates.", "related_rules": [ 1 ], "related_sections": [ 2 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) This Act may be called the Digital Personal Data Protection Act, 2023.", "(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 1, "amendments": [] }, { "section": 2, "title": "Definitions", "chapter": "I", "chapter_title": "Preliminary", "url": "https://dpdpr.in/act/section-2/", "markdown": "https://dpdpr.in/act/section-2/index.md", "in_simple_words": "This section explains the key words used in the Act, such as Data Principal, Data Fiduciary, personal data and consent manager. When the Act uses one of these words, it means exactly what this section says.", "for_individuals": "You are the Data Principal when the data is about you. If you are a child, your parent acts for you.", "for_businesses": "If you decide why and how personal data is used, you are a Data Fiduciary. If you only process data for someone else, you are a Data Processor.", "example": "A food delivery app that decides what customer data to collect is a Data Fiduciary. The cloud company that only stores that data for the app is a Data Processor.", "applies_to": "All readers; the definitions control the meaning of the whole Act.", "related_rules": [ 2 ], "related_sections": [ 3 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "In this Act, unless the context otherwise requires,", "(a) “Appellate Tribunal” means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997;", "(b) “automated” means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data;", "(c) “Board” means the Data Protection Board of India established by the Central Government under section 18;", "(d) “certain legitimate uses” means the uses referred to in section 7;", "(e) “Chairperson” means the Chairperson of the Board;", "(f) “child” means an individual who has not completed the age of eighteen years;", "(g) “Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;", "(h) “data” means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means;", "(i) “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;", "(j) “Data Principal” means the individual to whom the personal data relates and where such individual is:", "(i) a child, includes the parents or lawful guardian of such a child;", "(ii) a person with disability, includes her lawful guardian, acting on her behalf;", "(k) “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary;", "(l) “Data Protection Officer” means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10;", "(m) “digital office” means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode;", "(n) “digital personal data” means personal data in digital form;", "(o) “gain” means:", "(i) a gain in property or supply of services, whether temporary or permanent; or", "(ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration;", "(p) “loss” means:", "(i) a loss in property or interruption in supply of services, whether temporary or permanent; or", "(ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration;", "(q) “Member” means a Member of the Board and includes the Chairperson;", "(r) “notification” means a notification published in the Official Gazette and the expressions “notify” and “notified” shall be construed accordingly;", "(s) “person” includes:", "(i) an individual;", "(ii) a Hindu undivided family;", "(iii) a company;", "(iv) a firm;", "(v) an association of persons or a body of individuals, whether incorporated or not;", "(vi) the State; and", "(vii) every artificial juristic person, not falling within any of the preceding sub-clauses;", "(t) “personal data” means any data about an individual who is identifiable by or in relation to such data;", "(u) “personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;", "(v) “prescribed” means prescribed by rules made under this Act;", "(w) “proceeding” means any action taken by the Board under the provisions of this Act;", "(x) “processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction;", "(y) “she” in relation to an individual includes the reference to such individual irrespective of gender;", "(z) “Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10;", "(za) “specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder; and", "(zb) “State” means the State as defined under article 12 of the Constitution." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 2, "amendments": [] }, { "section": 3, "title": "Application of Act", "chapter": "I", "chapter_title": "Preliminary", "url": "https://dpdpr.in/act/section-3/", "markdown": "https://dpdpr.in/act/section-3/index.md", "in_simple_words": "The Act covers personal data in digital form in India. It also covers paper data that is later digitised. It covers processing outside India if it is linked to offering goods or services to people in India. It does not cover data used by a person for personal or household purposes, or data a person has made public herself.", "for_individuals": "Your data is protected when a company or the Government handles it digitally. Things you post publicly yourself are not covered.", "for_businesses": "Foreign companies that sell to people in India are covered too. Paper records become covered once you digitise them.", "example": "A shopping website based abroad that sells to customers in India must follow the Act for those customers' data.", "applies_to": "Anyone processing digital personal data in India, and anyone abroad processing it in connection with offering goods or services to people in India.", "related_rules": [], "related_sections": [ 2, 4, 17 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "Subject to the provisions of this Act, it shall:", "(a) apply to the processing of digital personal data within the territory of India where the personal data is collected:", "(i) in digital form; or", "(ii) in non-digital form and digitised subsequently;", "(b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;", "(c) not apply to:", "(i) personal data processed by an individual for any personal or domestic purpose; and", "(ii) personal data that is made or caused to be made publicly available by:", "(A) the Data Principal to whom such personal data relates; or", "(B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.", "Illustration.", "X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 3, "amendments": [] }, { "section": 4, "title": "Grounds for processing personal data", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-4/", "markdown": "https://dpdpr.in/act/section-4/index.md", "in_simple_words": "Personal data can be used only for a lawful purpose. There are only two grounds: the person has given consent, or the use is one of the certain legitimate uses listed in section 7. A lawful purpose is any purpose not expressly forbidden by law.", "for_individuals": "A company needs your consent, or one of the specific reasons in section 7, to use your data.", "for_businesses": "For each purpose, record whether you rely on consent or on a section 7 legitimate use.", "example": "A gym app uses your phone number to send booking reminders because you agreed to it when you signed up.", "applies_to": "Every person who processes personal data covered by the Act.", "related_rules": [], "related_sections": [ 6, 7 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,", "(a) for which the Data Principal has given her consent; or", "(b) for certain legitimate uses.", "(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 4, "amendments": [] }, { "section": 5, "title": "Notice", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-5/", "markdown": "https://dpdpr.in/act/section-5/index.md", "in_simple_words": "Before or when a company asks for consent, it must give a notice. The notice says what data it wants, why, how to withdraw consent or raise a grievance, and how to complain to the Board. If people consented before the Act started, the company must send them a notice as soon as reasonably practicable.", "for_individuals": "You should get a clear notice explaining what data is taken and why, before you agree.", "for_businesses": "Prepare a standalone, plain-language notice. Rule 3 lists what it must contain.", "example": "When you sign up on a food delivery app, a short screen lists your name, phone and address and says they are used to deliver your orders.", "applies_to": "Data Fiduciaries asking for consent.", "related_rules": [ 3 ], "related_sections": [ 6, 13 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her,", "(i) the personal data and the purpose for which the same is proposed to be processed;", "(ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and", "(iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.", "Illustration.", "X, an individual, opens a bank account using the mobile app or website of Y, a bank.", "To complete the Know-Your-Customer requirements under law for opening of bank account, X opts for processing of her personal data by Y in a live, video-based customer identification process. Y shall accompany or precede the request for the personal data with notice to X, describing the personal data and the purpose of its processing.", "(2) Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,", "(a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,", "(i) the personal data and the purpose for which the same has been processed;", "(ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and", "(iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed.", "(b) the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.", "Illustration.", "X, an individual, gave her consent to the processing of her personal data for an online shopping app or website operated by Y, an e-commerce service provider, before the commencement of this Act. Upon commencement of the Act, Y shall, as soon as practicable, give through email, in-app notification or other effective method information to X, describing the personal data and the purpose of its processing.", "(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 4, "amendments": [] }, { "section": 6, "title": "Consent", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-6/", "markdown": "https://dpdpr.in/act/section-6/index.md", "in_simple_words": "Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. It covers only the data needed for the stated purpose. You can withdraw consent at any time, and withdrawing must be as easy as giving it. You can also give and manage consent through a registered Consent Manager.", "for_individuals": "You can say no to extra data requests, and you can take back your consent later. The company must then stop using the data within a reasonable time, unless a law requires otherwise.", "for_businesses": "Ask only for data you need. Make withdrawal as easy as sign-up. You must be able to prove that you gave notice and got consent.", "example": "A telemedicine app asks for your contact list. Since it does not need your contacts to treat you, your consent covers only the medical service.", "applies_to": "Data Fiduciaries relying on consent, and Consent Managers.", "related_rules": [ 3, 4 ], "related_sections": [ 5, 7, 27 ], "commencement": [ { "part": "sub-sections (1) to (8) and (10)", "date": "2027-05-13", "in_force": false }, { "part": "sub-section (9)", "date": "2026-11-13", "in_force": false } ], "official_text": [ "(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.", "Illustration.", "X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.", "(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.", "Illustration.", "X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. She gives to Y her consent for (i) the processing of her personal data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the Data Protection Board of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.", "(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act.", "(4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.", "(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal.", "Illustration.", "X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processing of her personal data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processing for supply of the goods already ordered and paid for by X.", "(6) If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India.", "Illustration.", "X, a telecom service provider, enters into a contract with Y, a Data Processor, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processing of her personal data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processing of the personal data of Z for emailing bills.", "(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.", "(8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed.", "(9) Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.", "(10) Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 5, "amendments": [] }, { "section": 7, "title": "Certain legitimate uses", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-7/", "markdown": "https://dpdpr.in/act/section-7/index.md", "in_simple_words": "This section lists cases where data can be used without asking for fresh consent. Examples: you gave the data yourself for a purpose and did not object, Government benefits and services, legal duties, court orders, medical emergencies, epidemics, disasters, and certain employment purposes.", "for_individuals": "Some uses do not need your consent, but they are limited to the listed purposes.", "for_businesses": "Use a legitimate use only when the facts clearly fit one of the listed clauses. Keep a note of which clause you rely on.", "example": "You buy medicine and ask the pharmacy to text you the receipt. The pharmacy may use your number for that receipt.", "applies_to": "Data Fiduciaries, including the State and its instrumentalities.", "related_rules": [ 5 ], "related_sections": [ 4, 6 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:", "(a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data.", "Illustrations.", "(I) X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt.", "(II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X;", "(b) for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where:", "(i) she has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or", "(ii) such personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data.", "Illustration.", "X. a pregnant woman, enrols herself on an app or website to avail of government’s maternity benefits programme, while consenting to provide her personal data for the purpose of availing of such benefits. Government may process the personal data of X processing to determine her eligibility to receive any other prescribed benefit from the government;", "(c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State;", "(d) for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force;", "(e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India;", "(f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual;", "(g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health;", "(h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order.", "Explanation. For the purposes of this clause, the expression “disaster” shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005; or", "(i) for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 6, "amendments": [] }, { "section": 8, "title": "General obligations of Data Fiduciary", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-8/", "markdown": "https://dpdpr.in/act/section-8/index.md", "in_simple_words": "The Data Fiduciary is responsible for following the Act, even when a processor does the work. It must use processors only under a valid contract, keep data accurate when it matters, protect data with reasonable security, report breaches, delete data when no longer needed, publish a contact person and run a grievance system.", "for_individuals": "The company you deal with is responsible for your data, even if another company handles it for them.", "for_businesses": "This is the core compliance section. Rules 6 to 9 add detail on security, breaches, deletion and contact details.", "example": "A ride app stores trip data with a cloud vendor. If the vendor leaks it, the ride app is still responsible under the Act.", "applies_to": "All Data Fiduciaries, for their own processing and processing done for them by Data Processors.", "related_rules": [ 6, 7, 8, 9 ], "related_sections": [ 6, 13, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor.", "(2) A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract.", "(3) Where personal data processed by a Data Fiduciary is likely to be:", "(a) used to make a decision that affects the Data Principal; or", "(b) disclosed to another Data Fiduciary, the Data Fiduciary processing such personal data shall ensure its completeness, accuracy and consistency.", "(4) A Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.", "(5) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.", "(6) In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.", "(7) A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,", "(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and", "(b) cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor.", "Illustrations.", "(I) X, an individual, registers herself on an online marketplace operated by Y, an e-commerce service provider. X gives her consent to Y for the processing of her personal data for selling her used car. The online marketplace helps conclude the sale. Y shall no longer retain her personal data.", "(II) X, an individual, decides to close her savings account with Y, a bank. Y is required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X’s personal data for the said period.", "(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data Principal does not:", "(a) approach the Data Fiduciary for the performance of the specified purpose; and", "(b) exercise any of her rights in relation to such processing, for such time period as may be prescribed, and different time periods may be prescribed for different classes of Data Fiduciaries and for different purposes.", "(9) A Data Fiduciary shall publish, in such manner as may be prescribed, the business contact information of a Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary, the questions, if any, raised by the Data Principal about the processing of her personal data.", "(10) A Data Fiduciary shall establish an effective mechanism to redress the grievances of Data Principals.", "(11) For the purposes of this section, it is hereby clarified that a Data Principal shall be considered as not having approached the Data Fiduciary for the performance of the specified purpose, in any period during which she has not initiated contact with the Data Fiduciary for such performance, in person or by way of communication in electronic or physical form." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 7, "amendments": [] }, { "section": 9, "title": "Processing of personal data of children", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-9/", "markdown": "https://dpdpr.in/act/section-9/index.md", "in_simple_words": "For a child (under 18), the company must get verifiable consent from a parent before using the child's data. The same applies to a person with disability who has a lawful guardian. Companies must not process children's data in ways likely to harm them, and must not track, behaviourally monitor or target ads at children. Some exemptions apply under the Rules.", "for_individuals": "If your child uses an app, the app must check that you, a parent, agree first.", "for_businesses": "Build age and parental consent checks. Stop targeted ads and behavioural tracking for children unless an exemption in the Fourth Schedule applies.", "example": "A gaming app must get a parent's verifiable consent before creating an account for a 12-year-old.", "applies_to": "Data Fiduciaries processing data of children or of persons with disability who have a lawful guardian.", "related_rules": [ 10, 11, 12 ], "related_sections": [ 2, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.", "Explanation. For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.", "(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.", "(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.", "(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.", "(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 8, "amendments": [ { "where": "sub-section (1)", "for": "child or a person with disability", "read": "child or of a person with disability", "by": "S.O. 5458(E), 5 October 2026 (Removal of Difficulties Order, 2026)", "source": "https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf", "in_force_from": "2026-10-06" } ] }, { "section": 10, "title": "Additional obligations of Significant Data Fiduciary", "chapter": "II", "chapter_title": "Obligations of Data Fiduciary", "url": "https://dpdpr.in/act/section-10/", "markdown": "https://dpdpr.in/act/section-10/index.md", "in_simple_words": "The Government can name some companies, or classes of companies, as Significant Data Fiduciaries. It looks at things like how much and how sensitive the data is, and risk to people or the country. These companies have extra duties: a Data Protection Officer in India, an independent data auditor, and regular impact assessments and audits.", "for_individuals": "Large or high-risk companies must meet stricter standards for your data.", "for_businesses": "Check whether you have been notified. If so, plan the DPO, audit and DPIA work in Rule 13.", "example": "If a very large social media platform is notified, it must appoint a Data Protection Officer based in India.", "applies_to": "Data Fiduciaries notified as Significant Data Fiduciaries by the Central Government.", "related_rules": [ 13 ], "related_sections": [ 8, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including:", "(a) the volume and sensitivity of personal data processed;", "(b) risk to the rights of Data Principal;", "(c) potential impact on the sovereignty and integrity of India;", "(d) risk to electoral democracy;", "(e) security of the State; and", "(f) public order.", "(2) The Significant Data Fiduciary shall:", "(a) appoint a Data Protection Officer who shall:", "(i) represent the Significant Data Fiduciary under the provisions of this Act;", "(ii) be based in India;", "(iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; and", "(iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act;", "(b) appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act; and", "(c) undertake the following other measures, namely:", "(i) periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed;", "(ii) periodic data audit; and", "(iii) such other measures, consistent with the provisions of this Act, as may be prescribed." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 8, "amendments": [ { "where": "sub-section (2), clause (c), sub-clause (ii)", "for": "periodic audit", "read": "periodic data audit", "by": "S.O. 5458(E), 5 October 2026 (Removal of Difficulties Order, 2026)", "source": "https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf", "in_force_from": "2026-10-06" } ] }, { "section": 11, "title": "Right to access information about personal data", "chapter": "III", "chapter_title": "Rights and Duties of Data Principal", "url": "https://dpdpr.in/act/section-11/", "markdown": "https://dpdpr.in/act/section-11/index.md", "in_simple_words": "You can ask a company for a summary of your data and how it is used. You can also ask with whom it has shared your data, and what was shared. Sharing with authorities for crime or cyber incident purposes is excluded from part of this.", "for_individuals": "You can ask any company you gave consent to: what do you have about me, and who did you share it with?", "for_businesses": "Set up a way to answer access requests and track who you share data with.", "example": "You ask a food delivery app for a summary of your data. It lists your profile, orders and the delivery partners it shared your address with.", "applies_to": "Data Principals, against Data Fiduciaries they gave consent to.", "related_rules": [ 14 ], "related_sections": [ 12, 13 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,", "(a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;", "(b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and", "(c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed.", "(2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 9, "amendments": [] }, { "section": 12, "title": "Right to correction and erasure of personal data", "chapter": "III", "chapter_title": "Rights and Duties of Data Principal", "url": "https://dpdpr.in/act/section-12/", "markdown": "https://dpdpr.in/act/section-12/index.md", "in_simple_words": "You can ask to correct, complete, update or erase your data. The company must correct or update it. It must erase it unless it needs the data for the purpose you agreed to or a law requires it to keep it.", "for_individuals": "Wrong address or old phone number? Ask the company to fix it. You can also ask it to delete your data.", "for_businesses": "Have a process to correct and erase data, and record legal reasons when you must keep it.", "example": "You close your account on a shopping site and ask it to delete your data. It deletes it, except records it must keep under tax law.", "applies_to": "Data Principals and Data Fiduciaries.", "related_rules": [ 14 ], "related_sections": [ 8, 11, 15 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.", "(2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal,", "(a) correct the inaccurate or misleading personal data;", "(b) complete the incomplete personal data; and", "(c) update the personal data.", "(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 10, "amendments": [] }, { "section": 13, "title": "Right of grievance redressal", "chapter": "III", "chapter_title": "Rights and Duties of Data Principal", "url": "https://dpdpr.in/act/section-13/", "markdown": "https://dpdpr.in/act/section-13/index.md", "in_simple_words": "Companies and Consent Managers must give you an easy way to raise complaints. They must reply within the time set by the Rules. You must try this first before you go to the Board.", "for_individuals": "Complain to the company first. If you are not satisfied, you can then approach the Board.", "for_businesses": "Publish your grievance process. Rule 14(3) sets a maximum response period of ninety days.", "example": "A bank keeps sending you marketing messages after you withdrew consent. You first raise a grievance with the bank.", "applies_to": "Data Fiduciaries, Consent Managers and Data Principals.", "related_rules": [ 14 ], "related_sections": [ 27, 28 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.", "(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.", "(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 10, "amendments": [] }, { "section": 14, "title": "Right to nominate", "chapter": "III", "chapter_title": "Rights and Duties of Data Principal", "url": "https://dpdpr.in/act/section-14/", "markdown": "https://dpdpr.in/act/section-14/index.md", "in_simple_words": "You can nominate another person who can use your data rights if you die or become unable to act because of unsoundness of mind or infirmity of body.", "for_individuals": "You can choose someone you trust to manage your data rights if something happens to you.", "for_businesses": "Offer a way to register a nominee, as described in Rule 14(4).", "example": "You name your sister as nominee on a cloud photo service, so she can ask for your account to be erased.", "applies_to": "Data Principals and Data Fiduciaries.", "related_rules": [ 14 ], "related_sections": [ 11, 12 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.", "(2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 10, "amendments": [] }, { "section": 15, "title": "Duties of Data Principal", "chapter": "III", "chapter_title": "Rights and Duties of Data Principal", "url": "https://dpdpr.in/act/section-15/", "markdown": "https://dpdpr.in/act/section-15/index.md", "in_simple_words": "People also have duties. Do not pretend to be someone else, do not hide important facts when applying for Government identity documents, do not file false or frivolous complaints, and give only genuine information when asking for correction.", "for_individuals": "Use your rights honestly. Breaking these duties can lead to a penalty of up to ten thousand rupees.", "for_businesses": "You may refuse correction requests that are not supported by authentic information.", "example": "Filing many fake complaints against a company to harass it breaks this duty.", "applies_to": "Data Principals.", "related_rules": [], "related_sections": [ 12, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "A Data Principal shall perform the following duties, namely:", "(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;", "(b) to ensure not to impersonate another person while providing her personal data for a specified purpose;", "(c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;", "(d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and", "(e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 10, "amendments": [] }, { "section": 16, "title": "Processing of personal data outside India", "chapter": "IV", "chapter_title": "Special Provisions", "url": "https://dpdpr.in/act/section-16/", "markdown": "https://dpdpr.in/act/section-16/index.md", "in_simple_words": "Personal data can generally be sent abroad. The Government can, by notification, restrict transfers to particular countries or territories. Other Indian laws with stricter rules still apply.", "for_individuals": "Your data may be stored or processed abroad unless the Government restricts that country.", "for_businesses": "Track any countries notified under this section and sector rules, such as those of financial regulators.", "example": "An Indian travel app uses a server in another country. That is allowed unless the Government restricts that country.", "applies_to": "Data Fiduciaries transferring personal data outside India.", "related_rules": [ 15 ], "related_sections": [ 17 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.", "(2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 11, "amendments": [] }, { "section": 17, "title": "Exemptions", "chapter": "IV", "chapter_title": "Special Provisions", "url": "https://dpdpr.in/act/section-17/", "markdown": "https://dpdpr.in/act/section-17/index.md", "in_simple_words": "This section lists exemptions. Many duties do not apply in some cases, such as enforcing legal claims, court functions, crime prevention and investigation, certain mergers, and loan default checks. The Government can exempt some State bodies, and certain research. It can also exempt some Data Fiduciaries, including startups, from some duties.", "for_individuals": "In some situations, such as a police investigation, you cannot use the usual rights.", "for_businesses": "Do not assume an exemption applies. Most exemptions still require security safeguards under section 8(5).", "example": "Police processing data to investigate a crime do not have to give the usual consent notice.", "applies_to": "Specified processing, State instrumentalities notified by the Government, and Data Fiduciaries notified under this section.", "related_rules": [ 5, 16 ], "related_sections": [ 3, 7 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where:", "(a) the processing of personal data is necessary for enforcing any legal right or claim;", "(b) the processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function;", "(c) personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;", "(d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India;", "(e) the processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force; and", "(f) the processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.", "Explanation. For the purposes of this clause, the expressions “default” and", "“financial institution” shall have the meanings respectively assigned to them in sub-sections (12) and (14) of section 3 of the Insolvency and Bankruptcy Code, 2016.", "Illustration.", "X, an individual, takes a loan from Y, a bank. X defaults in paying her monthly loan repayment instalment on the date on which it falls due. Y may process the personal data of X for ascertaining her financial information and assets and liabilities.", "(2) The provisions of this Act shall not apply in respect of the processing of personal data:", "(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and", "(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.", "(3) The Central Government may, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including startups, as Data Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply.", "Explanation. For the purposes of this sub-section, the term “startup” means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to startups are allocated in the Central Government.", "(4) In respect of processing by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processing is for a purpose that does not include making of a decision that affects the Data Principal, sub-section (2) of section 12 shall not apply.", "(5) The Central Government may, before expiry of five years from the date of commencement of this Act, by notification, declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 11, "amendments": [] }, { "section": 18, "title": "Establishment of Board", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-18/", "markdown": "https://dpdpr.in/act/section-18/index.md", "in_simple_words": "This section sets up the Data Protection Board of India as a body corporate. The Government decides where its headquarters is.", "for_individuals": "The Board is where you can complain if a company does not fix your problem.", "for_businesses": "The Board will inquire into breaches and can impose penalties once its powers start.", "example": "The Board was established by notification G.S.R. 844(E) dated 13 November 2025, with its headquarters in the National Capital Region.", "applies_to": "The Central Government and the Board.", "related_rules": [ 17 ], "related_sections": [ 19, 27 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) With effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India.", "(2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.", "(3) The headquarters of the Board shall be at such place as the Central Government may notify." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 12, "amendments": [] }, { "section": 19, "title": "Composition and qualifications for appointment of Chairperson and Members", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-19/", "markdown": "https://dpdpr.in/act/section-19/index.md", "in_simple_words": "The Board has a Chairperson and other Members, in a number the Government notifies. They must have relevant expertise, and at least one must be a legal expert.", "for_individuals": "The Board is meant to be run by experts in law, technology and related fields.", "for_businesses": "No direct duty for businesses.", "example": "The Government invited applications for one Chairperson and four Members in May 2026.", "applies_to": "The Central Government and the Board.", "related_rules": [ 17 ], "related_sections": [ 18, 20 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The Board shall consist of a Chairperson and such number of other Members as the Central Government may notify.", "(2) The Chairperson and other Members shall be appointed by the Central Government in such manner as may be prescribed.", "(3) The Chairperson and other Members shall be a person of ability, integrity and standing who possesses special knowledge or practical experience in the fields of data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, or in any other field which in the opinion of the Central Government may be useful to the Board, and at least one among them shall be an expert in the field of law." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 12, "amendments": [] }, { "section": 20, "title": "Salary, allowances payable to and term of office", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-20/", "markdown": "https://dpdpr.in/act/section-20/index.md", "in_simple_words": "Rules fix the salary and service terms of the Chairperson and Members, and these cannot be reduced after appointment. They serve two-year terms and can be reappointed.", "for_individuals": "This protects Board Members from pressure through pay changes.", "for_businesses": "No direct duty for businesses.", "example": "The Fifth Schedule to the Rules sets the Chairperson's salary at rupees four lakh fifty thousand per month.", "applies_to": "The Chairperson and Members of the Board.", "related_rules": [ 18 ], "related_sections": [ 19, 21 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The salary, allowances and other terms and conditions of service of the Chairperson and other Members shall be such as may be prescribed, and shall not be varied to their disadvantage after their appointment.", "(2) The Chairperson and other Members shall hold office for a term of two years and shall be eligible for re-appointment." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 12, "amendments": [] }, { "section": 21, "title": "Disqualifications for appointment and continuation as Chairperson and Members of Board", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-21/", "markdown": "https://dpdpr.in/act/section-21/index.md", "in_simple_words": "A person cannot be or remain a Board Member if, for example, they are insolvent, convicted of an offence involving moral turpitude, unable to act, have a conflicting interest, or have abused their position. They must be heard before removal.", "for_individuals": "This protects the fairness of the Board.", "for_businesses": "No direct duty for businesses.", "example": "A Member who takes a large stake in a company appearing before the Board may be disqualified.", "applies_to": "The Chairperson and Members of the Board.", "related_rules": [], "related_sections": [ 19, 22 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) A person shall be disqualified for being appointed and continued as the Chairperson or a Member, if she:", "(a) has been adjudged as an insolvent;", "(b) has been convicted of an offence, which in the opinion of the Central Government, involves moral turpitude;", "(c) has become physically or mentally incapable of acting as a Member;", "(d) has acquired such financial or other interest, as is likely to affect prejudicially her functions as a Member; or", "(e) has so abused her position as to render her continuance in office prejudicial to the public interest.", "(2) The Chairperson or Member shall not be removed from her office by the Central Government unless she has been given an opportunity of being heard in the matter." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 13, "amendments": [] }, { "section": 22, "title": "Resignation by Members and filling of vacancy", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-22/", "markdown": "https://dpdpr.in/act/section-22/index.md", "in_simple_words": "Members can resign by written notice. Vacancies are filled by fresh appointment. For one year after leaving, they need Government approval to take a job, and must disclose jobs with companies they handled cases against.", "for_individuals": "This reduces conflicts of interest.", "for_businesses": "Be careful when hiring former Board Members within one year.", "example": "A former Member must disclose joining a company that faced proceedings before her.", "applies_to": "The Chairperson and Members of the Board.", "related_rules": [], "related_sections": [ 21 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The Chairperson or any other Member may give notice in writing to the Central Government of resigning from her office, and such resignation shall be effective from the date on which the Central Government permits her to relinquish office, or upon expiry of a period of three months from the date of receipt of such notice, or upon a duly appointed successor entering upon her office, or upon the expiry of the term of her office, whichever is earliest.", "(2) A vacancy caused by the resignation or removal or death of the Chairperson or any other Member, or otherwise, shall be filled by fresh appointment in accordance with the provisions of this Act.", "(3) The Chairperson and any other Member shall not, for a period of one year from the date on which they cease to hold such office, except with the previous approval of the Central Government, accept any employment, and shall also disclose to the Central Government any subsequent acceptance of employment with any Data Fiduciary against whom proceedings were initiated by or before such Chairperson or other Member." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 13, "amendments": [] }, { "section": 23, "title": "Proceedings of Board", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-23/", "markdown": "https://dpdpr.in/act/section-23/index.md", "in_simple_words": "The Board follows procedures set by the Rules, including digital meetings. Its decisions are not invalid just because of a vacancy or a small procedural defect. The senior-most Member acts if the Chairperson is absent.", "for_individuals": "The Board can still work even if a seat is empty.", "for_businesses": "Board orders are not void merely because of a vacancy or minor procedural defect.", "example": "Rule 19 sets a quorum of one-third of the membership for Board meetings.", "applies_to": "The Board.", "related_rules": [ 19 ], "related_sections": [ 26, 28 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The Board shall observe such procedure in regard to the holding of and transaction of business at its meetings, including by digital means, and authenticate its orders, directions and instruments in such manner as may be prescribed.", "(2) No act or proceeding of the Board shall be invalid merely by reason of:", "(a) any vacancy in or any defect in the constitution of the Board;", "(b) any defect in the appointment of a person acting as the Chairperson or other Member of the Board; or", "(c) any irregularity in the procedure of the Board, which does not affect the merits of the case.", "(3) When the Chairperson is unable to discharge her functions owing to absence, illness or any other cause, the senior-most Member shall discharge the functions of the Chairperson until the date on which the Chairperson resumes her duties." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 13, "amendments": [] }, { "section": 24, "title": "Officers and employees of Board", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-24/", "markdown": "https://dpdpr.in/act/section-24/index.md", "in_simple_words": "The Board can appoint officers and employees, with prior approval of the Central Government.", "for_individuals": "Staff support the Board's work.", "for_businesses": "No direct duty for businesses.", "example": "The Sixth Schedule to the Rules sets service terms for Board staff.", "applies_to": "The Board.", "related_rules": [ 21 ], "related_sections": [ 25 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "The Board may, with previous approval of the Central Government, appoint such officers and employees as it may deem necessary for the efficient discharge of its functions under the provisions of this Act, on such terms and conditions of appointment and service as may be prescribed." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 13, "amendments": [] }, { "section": 25, "title": "Members and officers to be public servants", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-25/", "markdown": "https://dpdpr.in/act/section-25/index.md", "in_simple_words": "The Chairperson, Members, officers and staff of the Board are treated as public servants when acting under the Act.", "for_individuals": "Board officials are accountable as public servants.", "for_businesses": "Laws that apply to public servants apply to Board officials.", "example": "Offering a bribe to a Board officer would be treated as an offence involving a public servant.", "applies_to": "The Board, its Members and staff.", "related_rules": [], "related_sections": [ 24 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "The Chairperson, Members, officers and employees of the Board shall be deemed, when acting or purporting to act in pursuance of provisions of this Act, to be public servants within the meaning of section 21 of the Indian Penal Code." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 13, "amendments": [] }, { "section": 26, "title": "Powers of Chairperson", "chapter": "V", "chapter_title": "Data Protection Board of India", "url": "https://dpdpr.in/act/section-26/", "markdown": "https://dpdpr.in/act/section-26/index.md", "in_simple_words": "The Chairperson supervises the Board's administration. She can authorise officers to examine complaints and assign cases to individual Members or groups of Members.", "for_individuals": "Complaints may be examined by officers and decided by one or more Members.", "for_businesses": "Your case may be heard by a single Member or a group.", "example": "The Chairperson assigns a breach inquiry to a group of two Members.", "applies_to": "The Chairperson of the Board.", "related_rules": [ 19 ], "related_sections": [ 23, 28 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "The Chairperson shall exercise the following powers, namely:", "(a) general superintendence and giving direction in respect of all administrative matters of the Board;", "(b) authorise any officer of the Board to scrutinise any intimation, complaint, reference or correspondence addressed to the Board; and", "(c) authorise performance of any of the functions of the Board and conduct any of its proceedings, by an individual Member or groups of Members and to allocate proceedings among them." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 14, "amendments": [] }, { "section": 27, "title": "Powers and functions of Board", "chapter": "VI", "chapter_title": "Powers, Functions and Procedure to Be Followed by Board", "url": "https://dpdpr.in/act/section-27/", "markdown": "https://dpdpr.in/act/section-27/index.md", "in_simple_words": "The Board can direct urgent steps after a breach, inquire into breaches and complaints, and impose penalties. It also handles breaches by Consent Managers and of their registration conditions, and references about intermediaries. It can issue directions and modify or suspend them.", "for_individuals": "Once in force, you can complain to the Board about a breach or a company not honouring your rights.", "for_businesses": "The Board can order urgent remedial measures after a breach. Its inquiry and penalty powers start on 13 May 2027, except clause (1)(d) on Consent Managers, which starts on 13 November 2026.", "example": "After a reported leak at an online store, the Board could direct it to reset passwords and inform users.", "applies_to": "The Board; Data Fiduciaries, Consent Managers and intermediaries subject to its powers.", "related_rules": [ 4, 7 ], "related_sections": [ 28, 33 ], "commencement": [ { "part": "all except clause (d) of sub-section (1)", "date": "2027-05-13", "in_force": false }, { "part": "clause (d) of sub-section (1)", "date": "2026-11-13", "in_force": false } ], "official_text": [ "(1) The Board shall exercise and perform the following powers and functions, namely:", "(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;", "(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;", "(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;", "(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and", "(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.", "(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.", "(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 14, "amendments": [] }, { "section": 28, "title": "Procedure to be followed by Board", "chapter": "VI", "chapter_title": "Powers, Functions and Procedure to Be Followed by Board", "url": "https://dpdpr.in/act/section-28/", "markdown": "https://dpdpr.in/act/section-28/index.md", "in_simple_words": "The Board works as an independent, digital-first body. It first checks whether there are enough grounds for an inquiry. During an inquiry it has some civil court powers, can pass interim orders, and must hear the person concerned. It can warn or impose costs on false or frivolous complaints.", "for_individuals": "If you file a false complaint, you can be warned or made to pay costs.", "for_businesses": "You will get a chance to be heard before any order or penalty.", "example": "The Board summons a company's records to check how a breach happened.", "applies_to": "The Board, complainants and persons under inquiry.", "related_rules": [ 20 ], "related_sections": [ 27, 29, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed.", "(2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder.", "(3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry.", "(4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.", "(5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act.", "(6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.", "(7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to:", "(a) summoning and enforcing the attendance of any person and examining her on oath;", "(b) receiving evidence of affidavit requiring the discovery and production of documents;", "(c) inspecting any data, book, document, register, books of account or any other document; and", "(d) such other matters as may be prescribed.", "(8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person.", "(9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.", "(10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard.", "(11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.", "(12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 14, "amendments": [] }, { "section": 29, "title": "Appeal to Appellate Tribunal", "chapter": "VII", "chapter_title": "Appeal and Alternate Dispute Resolution", "url": "https://dpdpr.in/act/section-29/", "markdown": "https://dpdpr.in/act/section-29/index.md", "in_simple_words": "Anyone unhappy with a Board order can appeal to the Appellate Tribunal (TDSAT) within sixty days. The Tribunal tries to decide within six months, working digitally as far as practicable.", "for_individuals": "Both you and the company can appeal a Board order.", "for_businesses": "Appeals go to TDSAT within sixty days of receiving the order.", "example": "A company fined by the Board files a digital appeal with TDSAT.", "applies_to": "Any person aggrieved by a Board order or direction.", "related_rules": [ 22 ], "related_sections": [ 30 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal.", "(2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed.", "(3) The Appellate Tribunal may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period.", "(4) On receipt of an appeal under sub-section (1), the Appellate Tribunal may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against.", "(5) The Appellate Tribunal shall send a copy of every order made by it to the Board and to the parties to the appeal.", "(6) The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it.", "(7) Where any appeal under sub-section (6) could not be disposed of within the period of six months, the Appellate Tribunal shall record its reasons in writing for not disposing of the appeal within that period.", "(8) Without prejudice to the provisions of section 14A and section 16 of the Telecom Regulatory Authority of India Act, 1997, the Appellate Tribunal shall deal with an appeal under this section in accordance with such procedure as may be prescribed.", "(9) Where an appeal is filed against the orders of the Appellate Tribunal under this Act, the provisions of section 18 of the Telecom Regulatory Authority of India Act, 1997 shall apply.", "(10) In respect of appeals filed under the provisions of this Act, the Appellate Tribunal shall, as far as practicable, function as a digital office, with the receipt of appeal, hearing and pronouncement of decisions in respect of the same being digital by design." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 15, "amendments": [] }, { "section": 30, "title": "Orders passed by Appellate Tribunal to be executable as decree", "chapter": "VII", "chapter_title": "Appeal and Alternate Dispute Resolution", "url": "https://dpdpr.in/act/section-30/", "markdown": "https://dpdpr.in/act/section-30/index.md", "in_simple_words": "Orders of the Appellate Tribunal can be enforced like a civil court decree.", "for_individuals": "Tribunal orders are enforceable.", "for_businesses": "Non-compliance with a Tribunal order can be enforced through civil court processes.", "example": "The Tribunal sends its order to a local civil court for execution.", "applies_to": "Parties to appeals.", "related_rules": [], "related_sections": [ 29 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) An order passed by the Appellate Tribunal under this Act shall be executable by it as a decree of civil court, and for this purpose, the Appellate Tribunal shall have all the powers of a civil court.", "(2) Notwithstanding anything contained in sub-section (1), the Appellate Tribunal may transmit any order made by it to a civil court having local jurisdiction and such civil court shall execute the order as if it were a decree made by that court." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 16, "amendments": [] }, { "section": 31, "title": "Alternate dispute resolution", "chapter": "VII", "chapter_title": "Appeal and Alternate Dispute Resolution", "url": "https://dpdpr.in/act/section-31/", "markdown": "https://dpdpr.in/act/section-31/index.md", "in_simple_words": "If the Board thinks a complaint can be solved by mediation, it can ask the parties to try mediation.", "for_individuals": "Your complaint might be settled through mediation instead of a full inquiry.", "for_businesses": "Consider mediation to resolve disputes quickly.", "example": "A user and an app agree, through a mediator, that the app will delete wrongly kept data.", "applies_to": "The Board and parties to complaints.", "related_rules": [], "related_sections": [ 28, 32 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "If the Board is of the opinion that any complaint may be resolved by mediation, it may direct the parties concerned to attempt resolution of the dispute through such mediation by such mediator as the parties may mutually agree upon, or as provided for under any law for the time being in force in India." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 16, "amendments": [] }, { "section": 32, "title": "Voluntary undertaking", "chapter": "VII", "chapter_title": "Appeal and Alternate Dispute Resolution", "url": "https://dpdpr.in/act/section-32/", "markdown": "https://dpdpr.in/act/section-32/index.md", "in_simple_words": "During proceedings, the Board may accept a voluntary undertaking from a person to take or stop some action. Once accepted, it bars further proceedings on those contents. Breaking the undertaking is treated as a breach of the Act.", "for_individuals": "A company may promise the Board to fix a problem instead of facing a full inquiry.", "for_businesses": "An undertaking can end proceedings, but breaking it can lead to a penalty.", "example": "A company promises to stop sharing location data with advertisers within thirty days.", "applies_to": "Persons in proceedings before the Board.", "related_rules": [], "related_sections": [ 28, 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28.", "(2) The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking.", "(3) The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking.", "(4) The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).", "(5) Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 16, "amendments": [] }, { "section": 33, "title": "Penalties", "chapter": "VIII", "chapter_title": "Penalties and Adjudication", "url": "https://dpdpr.in/act/section-33/", "markdown": "https://dpdpr.in/act/section-33/index.md", "in_simple_words": "If the Board finds a significant breach after an inquiry and a hearing, it can impose a monetary penalty listed in the Schedule. The highest listed amount is up to two hundred and fifty crore rupees. The Board must consider factors such as how serious the breach was and whether the company acted to fix it.", "for_individuals": "Penalties go to the Government; this section does not provide compensation to you.", "for_businesses": "Penalties depend on the type of breach and factors in sub-section (2). See the Schedule for maximum amounts.", "example": "Failing to take reasonable security safeguards can attract a penalty of up to two hundred and fifty crore rupees.", "applies_to": "Any person found by the Board to have committed a significant breach.", "related_rules": [], "related_sections": [ 34, 42 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.", "(2) While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:", "(a) the nature, gravity and duration of the breach;", "(b) the type and nature of the personal data affected by the breach;", "(c) repetitive nature of the breach;", "(d) whether the person, as a result of the breach, has realised a gain or avoided any loss;", "(e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action;", "(f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and", "(g) the likely impact of the imposition of the monetary penalty on the person." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 16, "amendments": [] }, { "section": 34, "title": "Crediting sums realised by way of penalties to Consolidated Fund of India", "chapter": "VIII", "chapter_title": "Penalties and Adjudication", "url": "https://dpdpr.in/act/section-34/", "markdown": "https://dpdpr.in/act/section-34/index.md", "in_simple_words": "All penalty money collected goes to the Consolidated Fund of India.", "for_individuals": "Penalties are not paid to affected individuals under this Act.", "for_businesses": "Penalty amounts are paid to the Government.", "example": "A penalty imposed by the Board is credited to the Consolidated Fund of India.", "applies_to": "The Board and persons paying penalties.", "related_rules": [], "related_sections": [ 33 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 17, "amendments": [] }, { "section": 35, "title": "Protection of action taken in good faith", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-35/", "markdown": "https://dpdpr.in/act/section-35/index.md", "in_simple_words": "No legal case can be filed against the Government, the Board or its people for things done in good faith under the Act.", "for_individuals": "You cannot sue officials for good faith actions under the Act.", "for_businesses": "Officials acting in good faith are protected from suits.", "example": "A Board officer who issues a direction in good faith cannot be sued for it.", "applies_to": "The Central Government, the Board, its Members and staff.", "related_rules": [], "related_sections": [], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "No suit, prosecution or other legal proceedings shall lie against the Central Government, the Board, its Chairperson and any Member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 17, "amendments": [] }, { "section": 36, "title": "Power to call for information", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-36/", "markdown": "https://dpdpr.in/act/section-36/index.md", "in_simple_words": "The Central Government can ask the Board, any Data Fiduciary or any intermediary to give it information for the purposes of the Act.", "for_individuals": "The Government can ask companies for information under this Act.", "for_businesses": "Rule 23 and the Seventh Schedule set out purposes and the officers who can ask.", "example": "An authorised officer asks a large platform for information to assess whether it should be a Significant Data Fiduciary.", "applies_to": "The Board, Data Fiduciaries and intermediaries.", "related_rules": [ 23 ], "related_sections": [ 37 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 17, "amendments": [] }, { "section": 37, "title": "Power of Central Government to issue directions", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-37/", "markdown": "https://dpdpr.in/act/section-37/index.md", "in_simple_words": "If the Board has penalised a company two or more times and advises blocking in the public interest, the Government can order blocking of public access to that company's information or services, after a hearing. Intermediaries must comply.", "for_individuals": "Repeat offenders can, in extreme cases, have their service blocked in India.", "for_businesses": "Repeated penalties can lead to blocking orders.", "example": "After two penalties against an app, the Board advises blocking and the Government directs that the app be blocked.", "applies_to": "The Central Government, Data Fiduciaries and intermediaries.", "related_rules": [], "related_sections": [ 33, 36 ], "commencement": [ { "part": "whole section", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the Board that:", "(a) intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances; and", "(b) advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India, after giving an opportunity of being heard to that Data Fiduciary, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information.", "(2) Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same.", "(3) For the purposes of this section, the expressions “computer resource”,", "“information” and “intermediary” shall have the meanings respectively assigned to them in the Information Technology Act, 2000." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 17, "amendments": [] }, { "section": 38, "title": "Consistency with other laws", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-38/", "markdown": "https://dpdpr.in/act/section-38/index.md", "in_simple_words": "This Act adds to other laws and does not replace them. If there is a conflict, this Act prevails to the extent of the conflict.", "for_individuals": "Other protections, such as banking or health laws, continue to apply too.", "for_businesses": "Comply with both this Act and sector laws.", "example": "A bank follows both the DPDP Act and banking regulations on data.", "applies_to": "Everyone.", "related_rules": [], "related_sections": [ 16 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.", "(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 18, "amendments": [] }, { "section": 39, "title": "Bar of jurisdiction", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-39/", "markdown": "https://dpdpr.in/act/section-39/index.md", "in_simple_words": "Civil courts cannot hear cases on matters the Board is empowered to decide, and no injunction can be granted against action under the Act.", "for_individuals": "For matters under the Act, you go to the Board, not a civil court.", "for_businesses": "Disputes on DPDP matters go to the Board and then the Appellate Tribunal.", "example": "You cannot file a civil suit asking only for a DPDP penalty against a company.", "applies_to": "Courts, complainants and parties.", "related_rules": [], "related_sections": [ 27, 29 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 18, "amendments": [] }, { "section": 40, "title": "Power to make rules", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-40/", "markdown": "https://dpdpr.in/act/section-40/index.md", "in_simple_words": "The Central Government can make rules to carry out the Act. This section lists topics for rules. The DPDP Rules, 2025 were made under this power.", "for_individuals": "Many details, such as breach reporting, are in the Rules.", "for_businesses": "Read the Act and the Rules together.", "example": "Rule 7 on breach intimation was made under this section.", "applies_to": "The Central Government.", "related_rules": [ 1 ], "related_sections": [ 41 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.", "(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:", "(a) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5;", "(b) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5;", "(c) the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6;", "(d) the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6;", "(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7;", "(f) the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8;", "(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;", "(h) the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8;", "(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;", "(j) the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9;", "(k) the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;", "(l) the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;", "(m) the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11;", "(n) the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12;", "(o) the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13;", "(p) the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14;", "(q) the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17;", "(r) the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19;", "(s) the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20;", "(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;", "(u) the terms and conditions of appointment and service of officers and employees of the Board under section 24;", "(v) the techno-legal measures to be adopted by the Board under sub-section (1) of section 28;", "(w) the other matters under clause (d) of sub-section (7) of section 28;", "(x) the form, manner and fee for filing an appeal under sub-section (2) of section 29;", "(y) the procedure for dealing an appeal under sub-section (8) of section 29;", "(z) any other matter which is to be or may be prescribed or in respect of which provision is to be, or may be, made by rules." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 18, "amendments": [] }, { "section": 41, "title": "Laying of rules and certain notifications", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-41/", "markdown": "https://dpdpr.in/act/section-41/index.md", "in_simple_words": "Rules, and notifications under sections 16 and 42, must be laid before both Houses of Parliament, which can modify or annul them.", "for_individuals": "Parliament can review the Rules.", "for_businesses": "Watch for changes made by Parliament.", "example": "The DPDP Rules are laid before Parliament after notification.", "applies_to": "The Central Government and Parliament.", "related_rules": [], "related_sections": [ 40, 42 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the rule or notification or both Houses agree that the rule or notification should not be made or issued, the rule or notification shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule or notification." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 19, "amendments": [] }, { "section": 42, "title": "Power to amend Schedule", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-42/", "markdown": "https://dpdpr.in/act/section-42/index.md", "in_simple_words": "The Government can change the penalty Schedule by notification, but cannot raise any penalty to more than twice the original amount.", "for_individuals": "Penalty limits can rise, but only up to double.", "for_businesses": "Maximum penalties may increase up to twice the original amounts.", "example": "The two hundred and fifty crore cap could at most become five hundred crore by notification.", "applies_to": "The Central Government.", "related_rules": [], "related_sections": [ 33 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.", "(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 19, "amendments": [] }, { "section": 43, "title": "Power to remove difficulties", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-43/", "markdown": "https://dpdpr.in/act/section-43/index.md", "in_simple_words": "If there are difficulties in applying the Act, the Government can issue orders to remove them, for up to three years from commencement. Orders are laid before Parliament.", "for_individuals": "This allows fixing practical problems early on.", "for_businesses": "Watch for any orders under this section.", "example": "An order clarifying a transitional issue could be issued under this section.", "applies_to": "The Central Government.", "related_rules": [], "related_sections": [ 40 ], "commencement": [ { "part": "whole section", "date": "2025-11-13", "in_force": true } ], "official_text": [ "(1) If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty.", "(2) No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act.", "(3) Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 19, "amendments": [] }, { "section": 44, "title": "Amendments to certain Acts", "chapter": "IX", "chapter_title": "Miscellaneous", "url": "https://dpdpr.in/act/section-44/", "markdown": "https://dpdpr.in/act/section-44/index.md", "in_simple_words": "This section changes three other laws. It amends the TRAI Act for the Appellate Tribunal, removes section 43A of the IT Act and makes related changes, and changes the RTI Act exemption for personal information.", "for_individuals": "Under the amended RTI Act, information that relates to personal information is exempt from disclosure.", "for_businesses": "Section 43A of the IT Act (compensation for failure to protect data) is omitted from 13 May 2027.", "example": "An RTI request for an official's personal details may be refused under the amended section 8(1)(j).", "applies_to": "Those affected by the TRAI Act, IT Act and RTI Act.", "related_rules": [], "related_sections": [ 29 ], "commencement": [ { "part": "sub-sections (1) and (3)", "date": "2025-11-13", "in_force": true }, { "part": "sub-section (2)", "date": "2027-05-13", "in_force": false } ], "official_text": [ "(1) In section 14 of the Telecom Regulatory Authority of India Act, 1997, in clause (c), for sub-clauses (i) and (ii), the following sub-clauses shall be substituted, namely:", "“(i) the Appellate Tribunal under the Information Technology Act, 2000;", "(ii) the Appellate Tribunal under the Airports Economic Regulatory Authority of India Act, 2008; and", "(iii) the Appellate Tribunal under the Digital Personal Data Protection Act, 2023.”.", "(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:", "(a) section 43A shall be omitted;", "(b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and", "(c) in section 87, in sub-section (2), clause (ob) shall be omitted.", "(3) In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:", "“(j) information which relates to personal information;”." ], "source_pdf": "https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf", "source_page": 19, "amendments": [] } ], "schedule": [ { "sl": "1.", "breach": "Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8.", "penalty": "May extend to two hundred and fifty crore rupees." }, { "sl": "2.", "breach": "Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach, under sub-section (6) of section 8.", "penalty": "May extend to two hundred crore rupees." }, { "sl": "3.", "breach": "Breach in observance of additional obligations in relation to children under section 9.", "penalty": "May extend to two hundred crore rupees." }, { "sl": "4.", "breach": "Breach in observance of additional obligations of Significant Data Fiduciary under section 10.", "penalty": "May extend to one hundred and fifty crore rupees." }, { "sl": "5.", "breach": "Breach in observance of the duties under section 15.", "penalty": "May extend to ten thousand rupees." }, { "sl": "6.", "breach": "Breach of any term of voluntary undertaking accepted by the Board under section 32.", "penalty": "Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted." }, { "sl": "7.", "breach": "Breach of any other provision of this Act or the rules made thereunder.", "penalty": "May extend to fifty crore rupees." } ] }