Why you can trust this course
We don't ask you to take our word for it. Every claim in every lesson is anchored to a Section, Rule, or judgment. This page is the master register of every authority we cite.
Legal basis snapshot: DPDP Act 2023 (No. 22 of 2023, assented 11 August 2023). DPDP Rules 2025 notified 13 November 2025 via Gazette Notifications G.S.R. 843(E), 844(E), 845(E) and 846(E). Sectoral overlays as in force August 2026: CERT-In Directions No. 20(3)/2022-CERT-In (28 April 2022); RBI Draft Data Governance Framework (15 July 2026, consultation closed 17 August 2026); SEBI CSCRF (20 August 2024); IRDAI Information and Cyber Security Guidelines 2026 (6 April 2026); Telecom Cyber Security Rules 2024 (21 November 2024); Aadhaar Data Security Regulations 2016. Constitutional context: Puttaswamy v. Union of India (2017) 10 SCC 1.
How this DPDP Rules 2025 Deep Dive / DPO Practitioner register is built
This trust page is the citation register for the DPDP Rules 2025 Deep Dive / DPO Practitioner course. It cites 45 authorities across 9 statutory instruments, drawn from the legal basis snapshot above (DPDP Act 2023 (No. 22 of 2023, assented 11 August 2023). DPDP Rules 2025 notified 13 November 2025 via Gazette Notifications G.S.R. 843(E), 844(E), 845(E) and 846(E). Sectoral overlays as in force August 2026: CERT-In Directions No. 20(3)/2022-CERT-In (28 April 2022); RBI Draft Data Governance Framework (15 July 2026, consultation closed 17 August 2026); SEBI CSCRF (20 August 2024); IRDAI Information and Cyber Security Guidelines 2026 (6 April 2026); Telecom Cyber Security Rules 2024 (21 November 2024); Aadhaar Data Security Regulations 2016. Constitutional context: Puttaswamy v. Union of India (2017) 10 SCC 1.).
Primary sources: DPDP Act 2023 (21 entries), DPDP Rules 2025 (16 entries), DPDP Gazette 2025 (2 entries).
Every claim in every DPDP Rules 2025 Deep Dive / DPO Practitioner lesson traces back to a Section, Rule, or judgment listed below.
If a lesson references a specific obligation, click the [Lx-Cy] marker in that
lesson to jump to the verbatim text in the register.
Our verification promise
- Every factual claim has a source. If we say "Section 9 allows a three-month limitation period", you can click the
[Lx-Cy]marker next to it and read the verbatim text of Section 9 of the Sexual Harassment of Women at Workplace Act, 2013. - Every source is on this page. Below you will find every Section, Rule and judgment we have relied on, grouped by category, with the verbatim text we hold in our register.
- Every source has a public link. Wherever an authoritative public link exists (India Code, the official court website, a reputable law-reports portal), we link to it.
- Bug bounty for errors. If you find a factual error in any lesson, write to [email protected] with the lesson, the claim and the corrected source. We will credit your account ₹1,000 for the first report of any verifiable error, ₹5,000 for a substantial error.
8
modules
28
lessons
45
cited authorities
recent
last reviewed
The full citation register
Every authority used in any lesson appears below. Click a row to expand the verbatim text.
Direction (ii) , CERT-In 6-hour cyber incident reporting (parallel to CSCRF) 28 Apr 2022
Plain summary: CERT-In Directions of 28 April 2022, Direction (ii): any service provider, intermediary, data centre, body corporate or Government organisation must mandatorily report cyber incidents listed in Annexure I to CERT-In within 6 hours of noticing. Runs in parallel with SEBI CSCRF 6-hour clock. Filing to one regulator does not satisfy the obligation to the other.
Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents.
Section 17 , Exemptions
Plain summary: Sections 4 to 10 (except Section 8(1) accountability and Section 8(5) security) do not apply to processing necessary for legal rights, judicial functions, offence prevention/investigation, and certain other specified categories. Central Government may exempt notified State instrumentalities on grounds of sovereignty, security, foreign relations, public order or incitement to any cognisable offence.
17. (1) The provisions of Chapter II [Sections 4-10], except sub-sections (1) and (5) of section 8, and those of Chapter III [Sections 11-15] and section 16 shall not apply where (a) processing is necessary for enforcing any legal right or claim; (b) processing by any court or tribunal or any body performing judicial or quasi-judicial functions; (c) processing necessary for prevention, detection, investigation or prosecution of any offence or contravention of any law; ...
(2) The Central Government may, by notification, exempt from the application of provisions of this Act (a) any instrumentality of the State on such grounds as sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to the commission of any cognisable offence relating to any of these; (b) processing for research, archiving or statistical purposes subject to standards.
Section 27 , Functions of Data Protection Board
Plain summary: On receipt of an intimation of personal data breach, the Board shall direct the Data Fiduciary to take urgent remedial or mitigation measures. On a complaint or reference, the Board shall inquire and impose penalty or direct any other measure. The Board acts as a digital office by default.
27. On and from the date of commencement of this Act, the Board shall, (a) on receipt of an intimation of personal data breach, direct any urgent remedial or mitigation measures in the event of a personal data breach, and inquire into such personal data breach and impose penalty as provided in this Act; (b) on a complaint made by a Data Principal or on a reference made to it by the Central Government or any State Government or in compliance of the directions of any court, inquire into such breach of the provisions of this Act by a Data Fiduciary or Consent Manager and impose penalty as provided in this Act.
Section 29 , Appeal to Appellate Tribunal
Plain summary: Any person aggrieved by an order or direction of the Board may prefer an appeal to the Telecom Disputes Settlement and Appellate Tribunal (designated as the Appellate Tribunal). Appeal must be filed within 60 days from the receipt of the Board order.
29. (1) Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal.
(2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed.
Section 36 , Power to call for information
Plain summary: Central Government may, for specified purposes, direct the Board or any Data Fiduciary or intermediary to furnish information. Purposes enumerated in the Seventh Schedule of the Rules. Central to constitutional challenge on transparency and state access.
36. The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.
Section 44(3) , Amendment to Right to Information Act
Plain summary: Section 44(3) amends Section 8(1)(j) of the RTI Act 2005 so that personal information is exempt from disclosure under RTI. Central to the constitutional challenge referred to a larger bench by the Supreme Court on 16 Feb 2026.
44. (3) In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely: "(j) information which relates to personal information;".
Schedule , Penalty ceilings 11 Aug 2023
Plain summary: Item 1: Failure to take reasonable security safeguards under Section 8(5) — up to two hundred and fifty crore rupees. Item 2: Failure to give breach intimation under Section 8(6) — up to two hundred crore rupees. Item 3: Failure of children's data obligations under Section 9 — up to two hundred crore rupees. Item 4: Failure of SDF obligations under Section 10 — up to one hundred and fifty crore rupees. Item 5: Data Principal duty breach under Section 15 — up to ten thousand rupees. Item 7: Residual — any other breach of Act or Rules — up to fifty crore rupees.
Schedule (Section 33):
Item 1 (Section 8(5) reasonable security safeguards): may extend to two hundred and fifty crore rupees.
Item 2 (Section 8(6) breach intimation to Board and affected Data Principals): may extend to two hundred crore rupees.
Item 3 (Section 9 additional obligations for children's personal data): may extend to two hundred crore rupees.
Item 4 (Section 10 additional obligations for Significant Data Fiduciary): may extend to one hundred and fifty crore rupees.
Item 5 (Section 15 duties of Data Principal): may extend to ten thousand rupees.
Item 6 (breach of any term of voluntary undertaking accepted by Board under Section 32): may extend to the extent applicable for the relevant Item.
Item 7 (any other breach of the provisions of this Act or rules): may extend to fifty crore rupees.
Section 1 , Short title, extent, commencement 11 Aug 2023
Plain summary: The Act is called the Digital Personal Data Protection Act, 2023. It extends to the whole of India and comes into force on dates the Central Government appoints in the Official Gazette, and different dates may be appointed for different provisions.
1. (1) This Act may be called the Digital Personal Data Protection Act, 2023.
(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act.
Section 10 , Additional obligations of Significant Data Fiduciary 11 Aug 2023
Plain summary: Central Government may notify any Data Fiduciary or class as Significant Data Fiduciary based on volume and sensitivity of personal data, risk to rights of Data Principals, potential impact on sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. Every SDF must appoint an India-resident Data Protection Officer responsible to the Board of Directors, an independent Data Auditor, and undertake periodic DPIAs and audits.
10. (1) The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary, on the basis of an assessment of such relevant factors as it may determine, including (a) the volume and sensitivity of personal data processed; (b) risk to the rights of Data Principal; (c) potential impact on the sovereignty and integrity of India; (d) risk to electoral democracy; (e) security of the State; and (f) public order.
(2) Every Significant Data Fiduciary shall (a) appoint a Data Protection Officer who shall (i) represent the Significant Data Fiduciary under the provisions of this Act; (ii) be based in India; (iii) be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary; (iv) be the point of contact for the grievance redressal mechanism under the provisions of this Act; (b) appoint an independent data auditor to carry out data audit; and (c) undertake (i) periodic Data Protection Impact Assessment; (ii) periodic audit; and (iii) such other measures as may be prescribed.
Section 11 , Right of Data Principal to access information 11 Aug 2023
Plain summary: Data Principal has the right to obtain from the Data Fiduciary a summary of personal data being processed and the processing activities undertaken with respect to it, identities of Fiduciaries and Processors with whom data has been shared, and any other prescribed information. Excludes disclosure to other Fiduciaries authorised by law to obtain the data for prevention, detection, investigation, prosecution or punishment of offences or cyber incidents.
11. (1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
Section 12 , Right to correction, completion, updating and erasure 11 Aug 2023
Plain summary: Data Principal has the right to correction, completion, updating and erasure of personal data for the processing of which she has previously given consent. Erasure must be honoured unless retention is required by law or for the specified purpose.
12. (1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent.
(2) A Data Fiduciary shall, upon receiving a request for such correction, completion or updating from a Data Principal, (a) correct the inaccurate or misleading personal data; (b) complete the incomplete personal data; and (c) update the personal data.
(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.
Section 13 , Right of grievance redressal 11 Aug 2023
Plain summary: Data Principal has the right to a readily available means of grievance redressal from the Data Fiduciary or Consent Manager. The Fiduciary or CM must respond to grievance within the prescribed period. The Data Principal must exhaust the internal grievance mechanism before approaching the Board.
13. (1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission regarding the performance of its obligations.
(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed.
(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
Section 14 , Right to nominate 11 Aug 2023
Plain summary: Data Principal has the right to nominate any other individual to exercise her rights in the event of her death or incapacity. Incapacity means inability to exercise rights under the Act due to unsoundness of mind or infirmity of body.
14. (1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act.
(2) For the purposes of this section, the expression "incapacity" means inability to exercise the rights of the Data Principal under the provisions of this Act due to unsoundness of mind or infirmity of body.
Section 15 , Duties of Data Principal 11 Aug 2023
Plain summary: Data Principal must comply with applicable law while exercising rights; must not impersonate another person while providing personal data; must not suppress material information; must not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and must furnish only authentic information when exercising the right to correction or erasure. Breach attracts penalty up to ten thousand rupees under the Schedule.
15. A Data Principal shall (a) comply with the provisions of all applicable laws while exercising rights under the provisions of this Act; (b) ensure not to impersonate another person while providing her personal data; (c) ensure not to suppress any material information; (d) ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and (e) furnish only such information as is verifiably authentic while exercising the right to correction or erasure.
Section 16 , Processing of personal data outside India 11 Aug 2023
Plain summary: The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary to countries or territories outside India. Nothing in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection or restriction on transfer.
16. (1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
(2) Nothing contained in sub-section (1) shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
Section 2 , Definitions 11 Aug 2023
Plain summary: Defines key terms including Data Principal, Data Fiduciary, Data Processor, personal data, personal data breach, processing, Significant Data Fiduciary, Consent Manager, child, and Board.
2. In this Act, unless the context otherwise requires (selected clauses):
(f) "child" means an individual who has not completed the age of eighteen years;
(i) "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
(j) "Data Principal" means the individual to whom the personal data relates, and where such individual is (i) a child, includes the parents or lawful guardian; (ii) a person with disability, includes her lawful guardian;
(k) "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary;
(t) "personal data" means any data about an individual who is identifiable by or in relation to such data;
(u) "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;
(x) "processing" means a wholly or partly automated operation or set of operations performed on digital personal data;
(z) "Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.
Section 3 , Application of the Act 11 Aug 2023
Plain summary: The Act applies to processing of digital personal data within India collected in digital form or digitised subsequently; and to processing outside India if in connection with offering goods or services to Data Principals in India. It does not apply to personal or domestic use, or to data made publicly available by the Data Principal or under law.
3. Subject to the provisions of this Act, it shall (a) apply to the processing of digital personal data within the territory of India where the personal data is collected (i) in digital form; or (ii) in non-digital form and digitised subsequently; (b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India; (c) not apply to (i) personal data processed by an individual for any personal or domestic purpose; and (ii) personal data that is made or caused to be made publicly available by (A) the Data Principal to whom such personal data relates; or (B) any other person under an obligation under any law for the time being in force in India to make such personal data publicly available.
Section 33 , Penalties for breach 11 Aug 2023
Plain summary: The Board may impose penalty as specified in the Schedule. Factors to consider include nature/gravity/duration of breach, type of data affected, repetitive nature, gain avoided or loss suffered, mitigation, proportionality and impact. Penalty is credited to the Consolidated Fund of India.
33. (1) If the Board determines on conclusion of an inquiry that non-compliance by a person is significant, it may, after giving the person a reasonable opportunity of being heard, impose such monetary penalty specified in the Schedule.
(2) While determining the amount of monetary penalty, the Board shall have regard to (a) nature, gravity and duration of the non-compliance; (b) type and nature of personal data affected; (c) repetitive nature of the non-compliance; (d) whether the person, as a result of the non-compliance, has realised a gain or avoided any loss; (e) whether the person took any action to mitigate the effects and consequences and the timeliness and effectiveness of the action; (f) whether the monetary penalty is proportionate and effective; and (g) likely impact of the imposition on the person.
(3) The amount so realised shall be credited to the Consolidated Fund of India.
Section 4 , Grounds for processing personal data 11 Aug 2023
Plain summary: Personal data may be processed only for a lawful purpose, either with the consent of the Data Principal, or for certain legitimate uses listed in Section 7.
4. (1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose, (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.
Section 5 , Notice to Data Principal 11 Aug 2023
Plain summary: Every consent request must be accompanied or preceded by a notice describing the personal data, purpose of processing, how to exercise rights, and how to complain to the Board. Notice must be available in English or any language listed in the Eighth Schedule.
5. (1) Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal, informing her (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the manner in which the Data Principal may make a complaint to the Board.
(3) The Data Fiduciary shall give the Data Principal the option to access the contents of the notice in English or any language specified in the Eighth Schedule to the Constitution of India.
Section 6 , Consent 11 Aug 2023
Plain summary: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose. Withdrawal must be as easy as giving consent. Consent may be given, managed, reviewed or withdrawn through a Consent Manager registered with the Board.
6. (1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
(4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.
(8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf.
(9) Every Consent Manager shall be registered with the Board.
(10) In a dispute, the burden of proving valid notice and consent lies on the Data Fiduciary.
Section 8 , General obligations of Data Fiduciary 11 Aug 2023
Plain summary: The Data Fiduciary is responsible for compliance regardless of any agreement to the contrary or Data Principal duty failure. Must engage Processors only under a valid contract. Must ensure data quality where the data will affect the Data Principal. Must implement reasonable security safeguards. Must intimate personal data breaches to the Board and affected Data Principals. Must erase personal data when consent is withdrawn or the specified purpose is no longer served, unless retention is required by law. Must publish contact details of the Data Protection Officer or a designated person to answer queries.
8. (1) A Data Fiduciary shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties, be responsible for complying with the provisions of this Act and the rules made thereunder.
(2) A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf only under a valid contract.
(5) A Data Fiduciary shall protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach.
(6) In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
(7) A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force, erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier.
(9) A Data Fiduciary shall publish the business contact information of a Data Protection Officer or of such other person who is able to answer questions from the Data Principal.
G.S.R. 844(E) , Establishment of Data Protection Board of India 13 Nov 2025
Plain summary: MeitY notification dated 13 November 2025 constituting the Data Protection Board of India with headquarters in the National Capital Region. Chairperson and Members are appointed through Search-cum-Selection Committees under Rule 17. As of August 2026, Chairperson and Members have not been fully appointed despite nomination calls on 6 May 2026 and 6 June 2026.
MeitY Notification G.S.R. 844(E) dated 13 November 2025. In exercise of the powers conferred by section 18 of the Digital Personal Data Protection Act, 2023, the Central Government hereby establishes the Data Protection Board of India with headquarters at the National Capital Region.
G.S.R. 846(E) , Digital Personal Data Protection Rules, 2025 13 Nov 2025
Plain summary: MeitY notification dated 13 November 2025 promulgating the Digital Personal Data Protection Rules, 2025. Rules are structured as 23 Rules plus Seven Schedules with three-phase commencement: 13 Nov 2025 (machinery), 13 Nov 2026 (Consent Managers), 13 May 2027 (substantive obligations).
MeitY Notification G.S.R. 846(E) dated 13 November 2025. In exercise of the powers conferred by sub-section (1) and clauses (a) to (n) of sub-section (2) of section 40 of the Digital Personal Data Protection Act, 2023, the Central Government hereby makes the following rules, namely: These rules may be called the Digital Personal Data Protection Rules, 2025.
First Schedule , Consent Manager conditions and obligations 13 Nov 2025
Plain summary: Part A: Conditions of registration. Indian company; minimum audited net worth ₹2 crore; demonstrate technical, operational and financial capability; disclosures on promoters/directors/KMPs; interoperability and technical/organisational measures certifications; no conflict of interest with Data Fiduciaries. Part B: Obligations. Operate as a data-blind pipe (must not read personal data); retain machine-readable consent logs for at least 7 years; interoperability standards notified by the Board; independent audit; adequate security; verifiable Data Principal rights process; no sub-contracting of core obligations.
First Schedule (See Rule 4)
Part A — Conditions of registration of Consent Manager:
1. The applicant shall be a company incorporated in India.
2. Net worth of not less than two crore rupees, evidenced by latest audited financial statements.
3. Capability, technical, operational and financial, to discharge functions of a Consent Manager.
4. Disclosures regarding promoters, directors, key managerial personnel and shareholders as may be prescribed.
5. Certifications regarding interoperability and technical and organisational measures.
6. No conflict of interest with any Data Fiduciary in a manner that impairs its independence.
Part B — Obligations of Consent Manager:
1. Provide services in a manner that ensures the interoperability of consent given, managed, reviewed or withdrawn.
2. Retain records of consent given, managed, reviewed or withdrawn for a period of not less than seven years or such longer period as the Data Principal may require.
3. Operate in an independent manner and not sub-contract core obligations.
4. Adhere to technical, interoperability and security standards specified by the Board.
5. Enable the Data Principal to give, manage, review and withdraw her consent through a platform that is transparent, accessible and easy to use.
Rule 1 , Short title, commencement 13 Nov 2025
Plain summary: The Rules are called the Digital Personal Data Protection Rules, 2025. Commencement is phased: Rules 1, 2 and 17-21 come into force on publication (13 Nov 2025); Rule 4 (Consent Manager registration) on 13 November 2026; Rules 3, 5-16, 22-23 on 13 May 2027.
1. (1) These rules may be called the Digital Personal Data Protection Rules, 2025.
(2) They shall come into force as follows: (a) rules 1, 2 and 17 to 21 on the date of their publication in the Official Gazette; (b) rule 4 on the expiry of one year from the date of publication; (c) rules 3, 5 to 16, 22 and 23 on the expiry of eighteen months from the date of publication.
Rule 10 , Verifiable consent for children 13 Nov 2025
Plain summary: Before processing personal data of a child, the Data Fiduciary must adopt appropriate technical and organisational measures to ensure verifiable consent of the parent is obtained. Verification may be by reference to reliable identity and age details already available with the Fiduciary, or voluntarily provided identity and age details or a virtual token mapped to such details issued by an entity entrusted by law or by a Digital Locker Service Provider.
10. (1) A Data Fiduciary shall, before processing personal data of a child, adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained.
(2) The verifiable consent shall be that the person identifying herself as the parent is an adult, either (a) by reference to reliable details of identity and age already available with the Data Fiduciary, or (b) by reference to identity and age details voluntarily provided by the parent, or by a virtual token mapped to such details, which is issued by an entity entrusted by law with maintaining such details, including a Digital Locker Service Provider.
Rule 13 , Additional obligations of Significant Data Fiduciary 13 Nov 2025
Plain summary: A Significant Data Fiduciary must (a) undertake a Data Protection Impact Assessment and independent audit at least once every 12 months from the date of notification as SDF, and shall submit the results of the DPIA and audit and observations to the Board; (b) exercise due diligence to verify that algorithmic software deployed for hosting, display, uploading, modification, publishing, transmission, storage or sharing of personal data is not likely to pose a risk to the rights of the Data Principal; (c) undertake such measures as the Central Government may specify, including in relation to certain classes of personal data or traffic data that shall not be transferred outside India.
13. (1) A Significant Data Fiduciary shall (a) undertake, at least once in a period of twelve months from the date of its notification as such, (i) a Data Protection Impact Assessment; and (ii) an audit; and (b) publish and submit to the Board a report containing significant observations arising from such Data Protection Impact Assessment and audit.
(2) A Significant Data Fiduciary shall exercise due diligence to verify that algorithmic software deployed by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data managed or processed by it is not likely to pose a risk to the rights of Data Principals.
(3) A Significant Data Fiduciary shall undertake such measures as the Central Government may specify from time to time to ensure that personal data and traffic data pertaining to its flow, as may be specified, is not transferred outside India.
Rule 14 , Rights of Data Principals — publication and response 13 Nov 2025
Plain summary: Every Data Fiduciary and Consent Manager must publish on its website or app the URL/app path to lodge access, correction, erasure and grievance requests; the particulars required to identify the Data Principal (username, customer ID, email, mobile, etc.); and the contact details of the DPO or the person authorised to respond. The Fiduciary must respond within the prescribed period, subject to a hard 90-day cap. The Data Principal may nominate any individual to exercise her rights on death or incapacity.
14. (1) A Data Fiduciary and a Consent Manager shall publish on its website or app or both the means using which a Data Principal may make a request in respect of exercise of her rights, the particulars, such as a username or an email address or a mobile phone number, or any other information, that are required to identify the Data Principal, and the period within which such request will be responded to.
(2) A Data Principal may nominate, in the manner published by the Data Fiduciary, any other individual to exercise her rights under section 14 in the event of death or incapacity.
Rule 15 , Cross-border transfer restrictions 13 Nov 2025
Plain summary: Data Fiduciary transferring personal data outside India shall comply with such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State or its instrumentality. As of August 2026, no restricted-country list has been notified. India's approach is a negative list — transfers are allowed by default subject to DPDP obligations and sectoral overlays.
15. The Central Government may, by general or special order, restrict the transfer of personal data, in respect of a Data Fiduciary or class of Data Fiduciary, to such foreign State, or to any person or entity under the control of or any agency of such foreign State, as may be so notified.
Rule 16 , Exemption for research, archiving and statistical processing 13 Nov 2025
Plain summary: Where personal data is processed for research, archiving or statistical purposes, provisions of the Act do not apply provided such processing is carried on in accordance with the standards specified in the Second Schedule (lawful basis, purpose limitation, minimisation, security, retention limit, intimation, contact publication).
16. Processing of personal data necessary for research, archiving or statistical purposes shall be undertaken in accordance with the standards specified in the Second Schedule.
Rule 23 , Confidentiality of information sought under Section 36 13 Nov 2025
Plain summary: Where information is called for by the Central Government under Section 36, the Data Fiduciary or intermediary shall not disclose such calling of information, or the information itself, to the Data Principal or the public if the direction so provides. This is the "gag" clause directly challenged in the Supreme Court as depriving Data Principals of notice of state access.
23. (1) The information called for under section 36 shall be furnished by the person concerned within the period, and in the form and manner, specified in the direction.
(2) Where the Central Government so specifies in the direction, the person from whom such information has been called shall not disclose the fact of such calling, or the information itself, to any other person including the Data Principal or the public.
Rule 3 , Notice by Data Fiduciary to Data Principal 13 Nov 2025
Plain summary: Notice under Section 5 must be presented independently of any other information or document. It must contain an itemised description of the personal data and an itemised description of the specified purpose including the goods or services enabled. Notice must set out how the Data Principal can withdraw consent, exercise rights and make a complaint to the Board. Notice must be available in English or any of the 22 Eighth Schedule languages on the Data Principal's option.
3. The notice given by a Data Fiduciary to a Data Principal under section 5 shall (a) be presented and be understandable independently of any other information that may be made available by such Data Fiduciary; (b) give in clear and plain language a fair account of the following details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, namely: (i) an itemised description of such personal data; and (ii) the specified purpose of and an itemised description of the goods or services to be provided or uses to be enabled by such processing; (c) provide the communication link for accessing the website or app or both of the Data Fiduciary; and (d) the manner in which the Data Principal may withdraw her consent, exercise her rights and make a complaint to the Board.
Rule 4 , Registration and obligations of Consent Manager 13 Nov 2025
Plain summary: A person may apply to the Board for registration as a Consent Manager if it fulfils the conditions in Part A of the First Schedule (Indian company, net worth at least two crore rupees, technical/operational/financial capability, no conflict of interest, etc.). A registered Consent Manager shall comply with the obligations in Part B (data-blind pipe, ≥7-year consent-log retention, interoperability, audit, security). Rule 4 commences 13 November 2026.
4. (1) A person seeking to be registered as a Consent Manager shall make an application to the Board fulfilling the conditions specified in Part A of the First Schedule.
(2) A Consent Manager shall comply with the obligations specified in Part B of the First Schedule.
(3) The Board may register a Consent Manager fulfilling the conditions and may cancel or suspend registration for non-compliance.
Rule 6 , Reasonable security safeguards 13 Nov 2025
Plain summary: Data Fiduciary must protect personal data by taking reasonable security safeguards including: appropriate data security measures (encryption, obfuscation, masking, virtual tokens); appropriate access controls; visibility on access via logs and monitoring; measures to detect unauthorised access and take mitigation action; retention of logs and personal data for a period of one year unless a longer period is required by law, for the purpose of enabling investigation; contractual arrangements with Data Processors for equivalent measures; and appropriate technical and organisational measures to ensure effective observance of the safeguards.
6. (1) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum: (a) appropriate data security measures, including securing personal data through its encryption, obfuscation or masking or the use of virtual tokens mapped to personal data; (b) appropriate measures to control access to the computer resources used by the Data Fiduciary or the Data Processor; (c) visibility on access to such personal data, through appropriate logs, monitoring and review; (d) reasonable measures for detection of unauthorised access and its mitigation, including through appropriate measures for continued processing in the event of confidentiality, integrity or availability of personal data being compromised; (e) reasonable measures for continued processing in the event of a personal data breach and enabling the investigation, including through appropriate retention of logs and personal data for a period of one year unless a longer period is required by law; (f) appropriate provisions in the contract entered into between the Data Fiduciary and Data Processor for taking such reasonable security safeguards; and (g) appropriate technical and organisational measures to ensure that the reasonable security safeguards are effectively implemented.
Rule 7 , DPDP breach notification (parallel to CSCRF for personal data) 13 Nov 2025
Plain summary: DPDP Rules 2025 Rule 7: on becoming aware of a personal data breach, the Data Fiduciary must intimate each affected Data Principal without delay and intimate the Data Protection Board without delay. Detailed report to the Board within 72 hours of awareness (extendable on written request). For a SEBI RE handling personal data, this runs in parallel with the CSCRF 6-hour clock.
DPDP Rules 2025 Rule 7. On becoming aware of any personal data breach, the Data Fiduciary shall intimate each affected Data Principal in a concise, clear and plain manner and without delay; and shall intimate the Data Protection Board without delay of the initial description, followed by an updated and detailed report within seventy-two hours of becoming aware (extendable on written request to the Board).
Rule 8 , Time period for erasure 13 Nov 2025
Plain summary: For the classes of Data Fiduciary and purposes specified in the Third Schedule, personal data of a Data Principal who has not approached the Fiduciary for the specified purpose nor exercised her rights for the specified period, is deemed no longer needed for the specified purpose and shall be erased. The Fiduciary must inform the Data Principal at least 48 hours before erasure that the personal data will be erased. The Seventh Schedule permits state functions to retain personal data, traffic data and logs for at least one year for sovereignty, security, public order and related purposes.
8. (1) The Data Fiduciaries and purposes as specified in the Third Schedule shall be deemed to no longer be serving the specified purpose if the Data Principal has, for the time period specified therein, neither approached the Data Fiduciary for the performance of the specified purpose, nor exercised any of her rights in relation to such processing, and the Data Fiduciary shall erase such personal data unless retention is required for compliance with any law for the time being in force.
(2) The Data Fiduciary shall, at least forty-eight hours before the time period specified in the Third Schedule expires, inform the Data Principal that unless she takes an action indicating continued use of the specified purpose or exercise of rights, her personal data will be erased.
(3) Retention of personal data, traffic data and logs by the Government or its instrumentalities may be for a period as prescribed under the Seventh Schedule for purposes related to sovereignty and integrity of India, security of the State, public order or similar functions.
Rule 9 , Contact information 13 Nov 2025
Plain summary: Data Fiduciary must publish on its website or app, and in every response to a Data Principal, the business contact information of the Data Protection Officer (for Significant Data Fiduciaries) or of a person authorised by it to respond to communications from Data Principals for the exercise of their rights.
9. A Data Fiduciary shall prominently publish on its website or app or both, and shall include in every response to a communication from a Data Principal for the exercise of her rights, the business contact information of a Data Protection Officer or of a person authorised by it to answer, on its behalf, the questions raised by such Data Principal.
Seventh Schedule , Purposes for calling information under Section 36 13 Nov 2025
Plain summary: Central Government may direct the Board, Data Fiduciary or intermediary to furnish information for purposes including: sovereignty and integrity of India; security of the State; friendly relations with foreign States; maintenance of public order; preventing incitement to commission of any cognisable offence relating to any of the above; assessment or notification of a Data Fiduciary as Significant Data Fiduciary; performance of any function of the Board. Central to constitutional challenge on unchecked state access.
Seventh Schedule (See Rules 8 and 22)
Purposes for which information may be called for under Section 36:
(a) Sovereignty and integrity of India;
(b) Security of the State;
(c) Friendly relations with foreign States;
(d) Maintenance of public order;
(e) Preventing incitement to the commission of any cognisable offence relating to any of the above;
(f) Assessment or notification of a Data Fiduciary as Significant Data Fiduciary under section 10;
(g) Performance of any function of the Board under the Act.
Third Schedule , Retention default periods 13 Nov 2025
Plain summary: For e-commerce entities with two crore or more registered users, online gaming intermediaries with fifty lakh or more registered users, and social media intermediaries with two crore or more registered users: personal data of a Data Principal who has not approached the Fiduciary nor exercised her rights for a period of three years is deemed no longer needed for the specified purpose and shall be erased. Fiduciary must inform the Data Principal at least 48 hours before erasure. Government has additional Seventh Schedule retention exceptions for state functions.
Third Schedule (See Rule 8)
Class of Data Fiduciary | Purpose | Time period
(i) E-commerce entity with 2 crore or more registered users in India | For which the Data Principal enrolled or provided personal data | 3 years from date the Data Principal last approached the Data Fiduciary or exercised any of her rights, whichever is later
(ii) Online gaming intermediary with 50 lakh or more registered users in India | Same | 3 years
(iii) Social media intermediary with 2 crore or more registered users in India | Same | 3 years
April 2026 Guidelines , IRDAI Information and Cyber Security Guidelines 2026 06 Apr 2026
Plain summary: IRDAI Information and Cyber Security Guidelines 2026 notified on 6 April 2026, mandating DPDP Act compliance for insurers, foreign reinsurance branches, brokers, corporate agents, web aggregators and third-party administrators. Requires grey-box / white-box VAPT every 6 months by CERT-In empanelled auditors; quarterly ISRMC meetings; post-quantum cryptography readiness planning; and revised cyber incident reporting protocols.
IRDAI Information and Cyber Security Guidelines 2026, notified 6 April 2026. Applies to all insurers, foreign reinsurance branches, insurance brokers, corporate agents, insurance web aggregators, and third-party administrators. Regulated entities shall (a) comply with the Digital Personal Data Protection Act, 2023 and rules made thereunder; (b) conduct VAPT in grey-box or white-box mode at least every six months by CERT-In empanelled auditors; (c) constitute an Information Security Risk Management Committee meeting at least quarterly; (d) plan for post-quantum cryptography readiness.
Puttaswamy v. UoI (2017) 10 SCC 1 , Right to privacy as a fundamental right 24 Aug 2017
Plain summary: Nine-judge Bench of the Supreme Court unanimously held that the right to privacy is a fundamental right protected under Article 21 of the Constitution of India. This ruling is the constitutional foundation of the DPDP Act 2023. Any restriction on privacy must satisfy the tests of legality, legitimate State aim, and proportionality.
The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution. (Justice K.S. Puttaswamy (Retd.) and Another v. Union of India and Others, Writ Petition (Civil) No. 494 of 2012, decided on 24 August 2017 by a nine-judge Bench of the Supreme Court of India.)
Draft July 2026 , RBI Data Governance Framework Draft (15 July 2026) 15 Jul 2026
Plain summary: Reserve Bank of India's Draft Guidance on Regulatory Expectations for Data Governance, released 15 July 2026, consultation closed 17 August 2026. Applies to banks, NBFCs, payment banks, co-operative banks, CICs and other Regulated Entities. Requires an annually-reviewed data governance framework, Board-level Data Governance Committee oversight, and data owners / data stewards / data custodians role structure. Explicitly binds compliance to the DPDP Act 2023 and Rules 2025.
RBI Draft Guidance on Regulatory Expectations for Data Governance, dated 15 July 2026. Applies to Scheduled Commercial Banks, Small Finance Banks, Payment Banks, Local Area Banks, Co-operative Banks, NBFCs, Housing Finance Companies, Credit Information Companies and All-India Financial Institutions. Requires each RE to (a) formulate a Board-approved Data Governance Framework reviewed at least annually; (b) constitute a Data Governance Committee at the Board level; (c) designate data owners, data stewards and data custodians; (d) comply with the Digital Personal Data Protection Act, 2023 and rules made thereunder.
Incident Reporting , 6-hour incident reporting to SEBI + CERT-In 20 Aug 2024
Plain summary: Reportable cyber incidents must be reported to SEBI within 6 hours of detection, in alignment with the CERT-In Directions of 28 April 2022. Reporting is via the SEBI Incident Reporting portal. A parallel filing must be made to CERT-In under CERT-In's own format. Filing to one regulator does not satisfy the obligation to the other. Detection triggers the clock, not confirmation.
Cyber Incident Reporting: All SEBI Regulated Entities shall report cyber security incidents to SEBI within six hours of detection, aligned with the reporting timeline under the CERT-In Directions dated 28 April 2022. Reporting shall be via the SEBI Incident Reporting portal. A separate report shall be filed with CERT-In in the format prescribed by CERT-In. Detection of an incident, not confirmation, starts the six-hour clock.
Incident reporting , Telecom Cyber Security Rules 2024 — 6-hour + 24-hour follow-up 21 Nov 2024
Plain summary: Telecom Cyber Security Rules 2024 notified on 21 November 2024 under Section 22 of the Telecommunications Act 2023. Telecommunication entities must report cyber security incidents within 6 hours of awareness, with all relevant details within 24 hours. DoT may collect and analyse traffic data (containing personal data) for cyber security purposes with no explicit retention cap, creating an overlap tension with DPDP Section 8(7) erasure obligations.
A telecommunication entity shall report every cyber security incident affecting its telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, followed by such other details as may be sought, within twenty-four hours of the report.
Found an error? We pay for it.
If you find a factual error in any lesson, write to [email protected] with the lesson title, the specific claim, and the corrected source.
- ₹1,000 credit for the first report of any verifiable factual error.
- ₹5,000 credit for a substantial error (e.g. a wrong section number, an obsolete ruling, a misrepresented holding).
- Credit on your dcomply Academy account usable against any future course.
We pay because we'd rather know than not know. If the law changes (and it will), we want to be the first to fix our lessons.
On this page
- 🟢 Our verification promise
- 📊 Course statistics
- 📚 Full citation register
- 🐛 Bug bounty for errors
Maintained by the dcomply Academy editorial team. Last reviewed recently.