Reading the Act and Rules as one instrument

The structural map. Nine chapters of the Act, twenty-three Rules, seven Schedules. Read this once and every subsequent lesson locates itself against a specific Section-Rule-Schedule triangulation.

Every practitioner who tries to read the DPDP Act alone gets lost inside three lessons. The Act is thin. Many provisions read "as may be prescribed". The prescription lives in the Rules. Reading them separately is a mistake. Reading them as one instrument is the trick.

Why the two-instrument structure exists

Indian statutory drafting frequently uses the Act-plus-Rules pattern to separate constitutional-level principles (in the Act) from operational specifics (in the Rules). The advantages: the Act is stable and difficult to amend (requiring Parliament); the Rules can be refined by executive action to keep pace with operational reality. The trade-off: practitioners must read both instruments together to understand any specific obligation. DPDP is a canonical example. Practitioner reading: build your compliance library with the Act and Rules cross-indexed so any specific question can be answered by the two together.

The Act at a glance

The DPDP Act 2023 has nine chapters:

Chapter I. Preliminary. Sections 1-3. Short title, definitions, application.
Chapter II. Obligations of Data Fiduciary. Sections 4-10. Grounds for processing, notice, consent, legitimate uses, general obligations, children, SDF.
Chapter III. Rights and Duties of Data Principal. Sections 11-15. Access, correction/erasure, grievance, nomination, duties.
Chapter IV. Special Provisions. Sections 16-17. Cross-border, exemptions.
Chapter V. Data Protection Board of India. Sections 18-26. Constitution, powers.
Chapter VI. Powers, Functions and Procedure. Sections 27-28. Board functions, inquiry, orders.
Chapter VII. Appellate Tribunal. Sections 29-32. Appeal, ADR, voluntary undertaking.
Chapter VIII. Penalties and Adjudication. Section 33.
Chapter IX. Miscellaneous. Sections 34-44. Rule-making, RTI amendment.

Plus a Schedule at the end setting out penalty ceilings.

Reading the Act as principles and the Rules as specifications

Every practitioner using both texts will develop a working shorthand: read the Act to understand what obligation exists; read the Rules to understand how to implement it. The Act tells you notice is required; the Rules tell you what the notice must contain. The Act tells you consent is required; the Rules tell you what makes consent valid. This is the two-instrument-as-one-tool discipline that mature DPDP practitioners internalise.

The Rules at a glance

The DPDP Rules 2025 have 23 Rules and 7 Schedules. Grouped by function:

Machinery. Rules 1-2, 17-21. Title, definitions, DPB Search-cum-Selection Committees, service conditions, digital office, meetings, officers.
Fiduciary-facing. Rules 3-6, 8-9. Notice, Consent Manager, State processing, security safeguards, retention, contact publication.
Breach. Rule 7.
Children and disability. Rules 10-12.
SDF-specific. Rule 13. DPIA, algorithmic due diligence, localisation.
Rights. Rule 14.
Cross-border and research. Rules 15-16.
State access. Rules 22-23. Section 36 information calls and confidentiality.

Seven Schedules:

First Schedule. Consent Manager conditions (Part A) and obligations (Part B).
Second Schedule. Standards for State processing and research/archiving/statistical processing.
Third Schedule. Retention default periods (3-year inactivity for e-commerce ≥2cr, gaming ≥50L, social media ≥2cr).
Fourth Schedule. Exemptions from Section 9(1)/(3) for classes and purposes (health, education, creches).
Fifth Schedule. DPB Chairperson and Members service conditions.
Sixth Schedule. DPB officers and employees.
Seventh Schedule. Purposes for Section 36 information calls.

The Schedules as operational-detail anchors

The seven Schedules pack substantial operational detail into a compact format. The First Schedule (Consent Manager conditions) will govern the entire CM ecosystem from November 2026. The Third Schedule (retention periods for specified Fiduciary categories) directly drives retention-programme design at large B2C platforms. The Fourth Schedule (children's-data exemptions for specific purposes and institutions) determines whether an ed-tech or health-tech Fiduciary can operate lawfully. The Seventh Schedule (purposes for Section 36 State-access) sets the scope of government-access exposure. Practitioner reading: the Schedules are not appendices; they are load-bearing operational text.

How the two texts hook together

Practical Section-Rule-Schedule triangulations you will use every week:

Notice: Section 5 → Rule 3 → language rendering from Eighth Schedule of the Constitution.
Consent: Section 6 → Rule 4 → First Schedule Part A + B.
Security: Section 8(5) → Rule 6 → 1-year log retention.
Breach: Section 8(6) → Rule 7 → two-stage clock (without delay + 72 hours).
Erasure: Section 8(7) → Rule 8 → Third Schedule (3-year inactivity for named platforms) → Seventh Schedule (State exception).
DPO: Section 10(2)(a) → Rule 13(1) (DPIA + audit) → Board-of-Directors accountability.
Rights: Sections 11-14 → Rule 14 → 90-day response cap.
Cross-border: Section 16(1) → Rule 15 → negative-list mechanism.
State access: Section 36 → Rules 22-23 → Seventh Schedule (purposes).
Penalties: Section 33 → Schedule to the Act (7 items).

What is not in the Rules

Two things a first-time reader expects and does not find:

First, the Rules do not define "child". The Act at Section 2(f) defines a child as anyone under 18 [L3-C1]. The Rules do not deviate.

Second, the Rules do not set numeric SDF thresholds. Section 10(1) lists factors (volume, sensitivity, risk, sovereignty, electoral democracy, State security, public order); the actual designation is a Government notification of specific Fiduciaries or classes [L3-C2]. Industry reads the Third Schedule's 2 cr / 50 lakh cut-offs as a proxy for "large scale", but that is inference, not text.

How to read the Rules in the correct order

A practitioner reading the Rules for the first time should go in this order, not in numerical order:

Rule 1 (commencement calendar)
Rule 2 (definitions)
Rule 3 (notice) and Rule 4 (Consent Manager) together
Rule 6 (security) and Rule 7 (breach) together
Rule 8 (retention) with the Third Schedule
Rule 14 (rights) with Rule 13 grievance points
Rules 10-12 (children and disability) with the Fourth Schedule
Rule 13 (SDF) with Section 10 of the Act
Rule 15 (cross-border) with Section 16
Rules 22-23 (state access) with Section 36

Each module of this course follows a similar order.

Where the DPB rules will sit

Separately from the DPDP Rules 2025, the Board will issue its own procedural rules under Section 28. As of August 2026 these have not been published; the digital-office mode is default under Rule 19 of the DPDP Rules. Watch the DPB website (once the Chairperson and Members are appointed) for Board Regulations on inquiry, evidence, and adjudication procedure.

Reading DPDP alongside international-transfer regimes

DPDP Section 16 and Rule 15 govern outbound transfers from India. This regime interacts with EU GDPR Chapter V (governing EU-to-India inbound flows) in complex ways. For an Indian Data Fiduciary that receives EU personal data (as processor under a GDPR-based DPA) and then processes it in India, both regimes apply: GDPR Chapter V for the EU-to-India flow with SCCs plus TIA, DPDP Section 16 for any subsequent India-to-third-country flow. Practitioner reading: understand the two regimes as distinct-but-coordinated layers; the practical implementation for a dual-regime entity is one integrated cross-border flow management programme.

The evolving-instrument discipline

DPDP is not a static instrument. Expect: additional MeitY Rules (Consent Manager operational-standards rules, SDF criteria rules if issued); DPB regulations on inquiry procedure; sector-specific FAQ documents; potential 2027-2028 amendments based on operational experience. Practitioner discipline: treat DPDP as an evolving instrument and build the update-monitoring capability into the DPO office from day one.

Preparing for the DPB's first published order

Once operational, the DPB will issue adjudication orders that will establish interpretive precedent for DPDP application. The first few orders (expected in Q3-Q4 2027) will set the tone. Practitioner reading: study each early DPB order carefully; the reasoning will guide practical interpretation for the industry over the following years. GDPR's regulatory landscape was similarly shaped by early large-fine reasoning documents from DPC Ireland, CNIL France, and the Italian Garante; expect a similar pattern for DPDP.