How to read the law

Before any lesson on substantive rights and obligations, learn how the DPDP Act is structured, what to ignore, and what to read closely.

Free preview 7 min read Verified

Legal basis

DPDP Act 2023 (No. 22 of 2023) + DPDP Rules 2025 (G.S.R. 843(E)-846(E), notified 13 November 2025)

Statutes look intimidating. The DPDP Act is shorter than most, but it still uses cross-references, defined terms, and conditional language that can trip a first-time reader. This lesson teaches you how to read it. The structure The Act is organised into nine chapters: Chapter I, Preliminary: short title, commencement, application, definitions (Sections 1 to 3) Chapter II, Obligations of Data Fiduciary: grounds for processing, notice, consent, certain legitimate uses, general obligations, children's data, Significant Data Fiduciaries (Sections 4 to 10) Chapter III, Rights and Duties of Data Principal: access, correction…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

DPDP Rules 2025, Rule 7 (Breach intimation) L2-C1

Rule 7: intimate affected Data Principals and the Board without delay; detailed report to the Board within 72 hours or longer period the Board allows. Gazette G.S.R. 846(E) of 13 Nov 2025. SDF duties are Rule 13, not Rule 12.

DPDP Rules 2025, Rule 12 (Exemptions from Section 9(1) and (3) for Fourth Schedule classes) L2-C2

The provisions of sub-sections (1) and (3) of Section 9 do not apply to the classes of Data Fiduciary and purposes specified in the Fourth Schedule. Includes clinical and mental health establishments, allied healthcare professionals, educational institutions and creches/day-care centres. Restricted to specified purposes: child safety, welfare, transportation tracking, subsidies/benefits, obligation under law, and similar.

DPDP Act 2023, Section 6 (Consent) L2-C3

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose. Withdrawal must be as easy as giving consent. Consent may be given, managed, reviewed or withdrawn through a Consent Manager registered with the Board.

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: DPDPA 101: Why this law, why now

Module 2: The Five Players

The Data Principal
The Data Fiduciary
The Data Processor
Significant Data Fiduciary and Consent Manager

Module 3: Data Principal Rights

Right to access information about personal data (Section 11)
Right to correction and erasure (Section 12)
Right of grievance redressal (Section 13)
Right to nominate (Section 14)
Duties of Data Principal (Section 15)

Module 4: Data Fiduciary Obligations

Lawful grounds for processing (Section 4)
Notice (Section 5 and Rule 3)
Certain legitimate uses (Section 7)
General obligations: security, breach, erasure, DPO contact (Section 8)
Children's data (Section 9 and Rule 10)

Module 5: Implementation Toolkit

Data mapping
Record of Processing Activities (RoPA)
Consent architecture
Breach response runbook
Retention design

Module 6: SDF, DPIA and DPO

Becoming a Significant Data Fiduciary
The Data Protection Officer
Data Protection Impact Assessment
Independent audit and algorithmic diligence

Module 7: Enforcement and Penalties

The Data Protection Board of India
The Schedule penalty matrix
Handling a Board inquiry
Voluntary undertakings, ADR, and the appeals path

Module 8: AI, sectoral overlays and DPDPA

The AI lifecycle under DPDPA
Data minimisation for AI systems
Notice and consent design for AI
Fairness, bias, and explainability
EU AI Act risk tiers mapped to DPDPA
Machine unlearning and the right to erasure
RBI Data Governance Framework for BFSI (July 2026 draft)