Section 40

Power to make rules

The enabling section under which the DPDP Rules 2025 were made, and the list of matters that may be prescribed.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1): The Central Government may, by notification, make rules to carry out the provisions of the Act.
(2): Sub-section (2) lists the specific matters that may be prescribed by rules, including the manner of giving notice, the conditions for Consent Manager registration, the standards for security safeguards and breach intimation, and the periods for retention and grievance response.

In practice

Every rule in the DPDP Rules 2025 traces back to a clause of s.40(2). It is worth citing when the question is whether a rule is within power, and it is the section the notification G.S.R. 846(E) itself was issued under.

Rule 1Short title and commencementNames the Rules and staggers them across three commencement dates rather than switching them on together.s.41Laying of rules and notifications before ParliamentRequires every rule and notification under the Act to be laid before both Houses of Parliament.s.1Short title and commencementNames the Act and lets the Central Government bring different provisions into force on different dates.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 40 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next