The statute, plainly
The DPDP Act, section by section.
India’s Digital Personal Data Protection Act 2023 and the Rules notified under it in November 2025, written out one provision at a time. What each one asks of you, when it starts applying, and what it costs to get wrong.
44 sections · 23 rules · 8 schedules · every page carries its citation and its commencement date
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source. When the words themselves matter, read the gazette: the Act was published on 11 August 2023, and the Rules were notified vide G.S.R. 846(E) on 13 November 2025.
Commencement
Three dates, not one.
Rule 1(2) to 1(4) stagger the Rules across eighteen months. The Board has been live since publication; most of what a business is actually judged against arrives on the last of these dates.
01Live
13 November 2025
The Board, and the complaint mechanism
Rules 1, 2 and 17 to 21 came into force on publication. The Data Protection Board exists, it functions as a digital office, and a Data Principal can complain to it.
02Next
13 November 2026
Consent Manager registration opens
Rule 4 and the First Schedule commence. A company meeting the Part A conditions can apply to the Board to register as a Consent Manager.
03The deadline
13 May 2027
The substantive obligations
Rules 3, 5 to 16, 22 and 23 commence together. Notice, security safeguards, breach intimation, retention and erasure, children’s consent, Significant Data Fiduciary duties, rights handling and cross-border transfer all land on the same day.
The Act
The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Gazette of India, Extraordinary, Part II, Section 1. Assented 11 August 2023. Restated as amended by S.O. 5458(E) of 5 October 2026.
Chapter I. Preliminary
s.1Short title and commencementNames the Act and lets the Central Government bring different provisions into force on different dates.s.2DefinitionsDefines the terms the whole Act turns on, including who counts as a child, a Data Fiduciary and a Data Processor.s.3Application of the ActSets the territorial and material reach: digital personal data processed in India, and offshore processing tied to offering goods or services into India.
Chapter II. Obligations of Data Fiduciary
s.4Grounds for processing personal dataPersonal data may be processed for a lawful purpose on one of exactly two grounds: consent, or a listed legitimate use.s.5NoticeEvery consent request must carry, or be preceded by, a notice stating the data, the purpose, how to exercise rights and how to complain to the Board.s.6ConsentSets the standard for valid consent, the right to withdraw it as easily as it was given, and the rule that the Data Fiduciary carries the burden of proving both.s.7Certain legitimate usesThe closed list of situations where personal data may be processed without consent, from voluntary provision to medical emergencies and employment.s.8General obligations of Data FiduciaryPenalty bandThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.s.9Processing of personal data of childrenPenalty bandRequires verifiable parental consent before processing a child’s data, and bans tracking, behavioural monitoring and targeted advertising directed at children.s.10Additional obligations of Significant Data FiduciaryPenalty bandLets the Central Government designate Significant Data Fiduciaries and imposes a DPO, an independent auditor and periodic impact assessments on them.
Chapter III. Rights and Duties of Data Principal
s.11Right to access information about personal dataGives the Data Principal the right to a summary of her data and the processing, and to know who it has been shared with.s.12Right to correction and erasure of personal dataGives the Data Principal the right to have her data corrected, completed, updated or erased.s.13Right of grievance redressalGives the Data Principal a right to readily available grievance redressal, and makes exhausting it a precondition to approaching the Board.s.14Right to nominateLets a Data Principal nominate someone to exercise her rights if she dies or becomes incapable of exercising them.s.15Duties of Data PrincipalPenalty bandPlaces duties on the Data Principal, including not impersonating anyone and not filing frivolous complaints.
Chapter IV. Special Provisions
s.16Processing of personal data outside IndiaLets the Central Government restrict transfers of personal data to notified countries, and preserves stricter transfer rules found in other laws.s.17ExemptionsLists where most of the Act is switched off, including legal claims, regulatory functions, offshore contracts and research.
Chapter V. Data Protection Board of India
s.18Establishment of the Data Protection Board of IndiaEstablishes the Data Protection Board of India as a body corporate.s.19Composition and appointment of Board membersSets the Board’s composition, with the Chairperson and Members appointed by the Central Government and at least one Member an expert in law.s.20Salary, allowances and term of officeFixes the terms of service for the Chairperson and Members, with a two-year term and eligibility for re-appointment.s.21Disqualifications for appointment and continuationLists the grounds on which a person may not be appointed to, or continue on, the Board.s.22Resignation and filling of vacanciesProvides for resignation of members and how vacancies are filled.s.23Proceedings of the BoardLets the Board regulate its own procedure and transact business by digital means.s.24Officers and employees of the BoardAllows the Board to appoint the officers and employees it needs.s.25Members and officers to be public servantsTreats the Chairperson, Members, officers and employees of the Board as public servants under the Indian Penal Code.s.26Powers of the ChairpersonGives the Chairperson general superintendence over the Board and its case allocation.
Chapter VI. Powers, Functions and Procedure of the Board
s.27Powers and functions of the BoardSets out what the Board actually does: acts on breach intimations and complaints, inquires, directs remedial measures and imposes penalties.s.28Procedure to be followed by the BoardMakes the Board a digital-by-design office with civil court powers, natural justice obligations and the ability to award costs against frivolous complaints.
Chapter VII. Appeal and Alternate Dispute Resolution
s.29Appeal to the Appellate TribunalGives a sixty-day right of appeal from a Board order to the Appellate Tribunal, which is the TDSAT.s.30Orders of the Appellate Tribunal executable as a decreeMakes a Tribunal order enforceable as if it were a decree of a civil court.s.31Alternate dispute resolutionLets the Board refer a complaint to mediation where a dispute is suited to it.s.32Voluntary undertakingPenalty bandLets the Board accept a voluntary undertaking at any stage, which bars proceedings on its contents but binds the giver.
Chapter VIII. Penalties and Adjudication
Chapter IX. Miscellaneous
s.35Protection of action taken in good faithBars suits and prosecutions against the Government, the Board and their officers for acts done in good faith.s.36Power to call for informationLets the Central Government require the Board, a Data Fiduciary or an intermediary to furnish information.s.37Power of Central Government to issue directions to block accessAllows blocking of a Data Fiduciary’s service in the public interest after penalties have been imposed in two or more instances.s.38Act to have overriding effectMakes the Act additional to other laws, and gives it primacy where a conflict cannot be reconciled.s.39Bar of jurisdiction of civil courtsRemoves civil court jurisdiction over matters the Board or the Appellate Tribunal is empowered to decide.s.40Power to make rulesThe enabling section under which the DPDP Rules 2025 were made, and the list of matters that may be prescribed.s.41Laying of rules and notifications before ParliamentRequires every rule and notification under the Act to be laid before both Houses of Parliament.s.42Power to amend the ScheduleLets the Central Government amend The Schedule, but caps any increase at twice the original penalty.s.43Power to remove difficultiesLets the Central Government issue orders removing difficulties in giving effect to the Act, for a limited period.s.44Amendments to certain ActsAmends the TRAI Act, removes section 43A of the IT Act, and substitutes the personal information exemption in the RTI Act.
The Schedule
The Rules
The Digital Personal Data Protection Rules, 2025. Notified vide G.S.R. 846(E) by the Ministry of Electronics and Information Technology on 13 November 2025, under Section 40.
Preliminary
Notice and consent
Rule 3Notice given by Data Fiduciary to Data PrincipalMay 2027Specifies what a notice under Section 5 must contain: a standalone document, an itemised description of the data, and the routes to withdraw consent, exercise rights and complain.Rule 4Registration and obligations of Consent ManagerNov 2026Sets the route to registration as a Consent Manager, the Board’s power to reject, suspend or cancel it, and where the ongoing obligations live.
Obligations of Data Fiduciary
Rule 5Processing for State subsidy, benefit, service or licenceMay 2027Applies the Second Schedule standards to State processing under Section 7(b) and defines the terms that trigger it.Rule 6Reasonable security safeguardsMay 2027Turns the Section 8(5) safeguards obligation into a minimum checklist: encryption, access control, logging, backups, one-year log retention and processor contract terms.Rule 7Intimation of personal data breachMay 2027Sets two clocks after a breach: immediate notice to affected principals and to the Board, then a detailed report to the Board within seventy-two hours.Rule 8Retention, erasure, and the pre-erasure warningMay 2027Fixes when the specified purpose is deemed no longer served for listed classes, requires a warning at least 48 hours before erasure, and sets a one-year minimum log retention.Rule 9Contact information of the person answering questions about processingMay 2027Requires the contact details of the DPO, or of a person who can answer processing questions, to be published prominently and repeated in every rights-request response.
Children and guardianship
Rule 10Verifiable consent for processing a child’s personal dataMay 2027Requires technical measures to obtain verifiable parental consent, and due diligence that the person claiming to be a parent is an identifiable adult.Rule 11Verifiable consent for a person with disability who has a lawful guardianMay 2027Requires due diligence that a guardian giving consent was actually appointed under the applicable guardianship law.Rule 12Exemptions from certain child-related obligationsMay 2027Switches off Sections 9(1) and 9(3) for the classes and purposes listed in the Fourth Schedule, subject to conditions.
Significant Data Fiduciaries
Data Principal rights
Cross-border transfer and exemptions
Rule 15Transfer of personal data outside IndiaMay 2027Subjects transfers abroad to any requirements the Central Government specifies for making data available to a foreign State or its agencies.Rule 16Exemption for research, archiving and statistical purposesMay 2027Disapplies the Act to research, archiving and statistical processing carried on in line with the Second Schedule standards.
The Board, appeals and information
Rule 17Search-cum-Selection CommitteesSets up the committees that recommend candidates for Chairperson and Members of the Board.Rule 18Salary, allowances and service conditions of Chairperson and MembersApplies the Fifth Schedule terms to the Chairperson and Members of the Board.Rule 19Meetings of the Board and the six-month inquiry windowGoverns Board meetings and quorum, and requires an inquiry to be completed within six months, extendable in three-month steps.Rule 20Functioning of the Board as a digital officeRequires the Board to operate as a digital office, including hearings conducted digitally.Rule 21Officers and employees of the BoardApplies the Sixth Schedule terms to the officers and employees of the Board.Rule 22Appeal to the Appellate TribunalMay 2027Requires appeals to be filed digitally, with the fee set under the TRAI Act and payable through UPI.Rule 23Power to call for informationMay 2027Lets authorised persons listed in the Seventh Schedule require information from a Data Fiduciary or intermediary.
Schedules to the Rules
Sch. IConsent Manager: registration conditions and obligationsNov 2026Part A sets the bar to register as a Consent Manager. Part B sets the thirteen obligations that continue once registered.Sch. IIStandards for State processing and for the research exemptionMay 2027The seven standards that State processing under Section 7(b) and exempt research processing must both meet.Sch. IIIRetention periods by class of Data FiduciaryMay 2027Three classes of large platform, each with a three-year erasure period running from the Data Principal’s last contact.Sch. IVChild-related exemptions: classes and purposesMay 2027Part A lists the classes exempt from Sections 9(1) and 9(3); Part B lists the exempt purposes.Sch. VSalary and service terms of Chairperson and MembersFixes the pay and service conditions of the Board’s Chairperson and Members.Sch. VIService terms of Board officers and employeesSets the terms and conditions of service for the Board’s officers and employees.Sch. VIIPurposes and authorised persons for calling for informationMay 2027Lists who may call for information and for what purposes, and supplies the retention purposes Rule 8(3) refers to.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
The Act moves: commencement dates, Board notifications, the first enforcement orders. One email a month on what actually changed, every claim cited to its section, the same way these pages are.
Knowing the section is the easy half.
The harder half is proving, on a named date, that you met it. Gevox scans a live website against these provisions and ties every finding to the exact sub-section it engages, then produces the documents that close the gap.