The Law
The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, verbatim from the gazette, one page per section, rule and schedule. Each page says how many of the 217 obligations in our library it creates, and what the highest penalty cap among them is.
The Act
- Section 1
- Section 2 Definitions
- Section 3
- Section 4 Grounds for
- Section 5 Notice
- Section 6
- Section 7 Certain
- Section 8
- Section 9 Processing of
- Section 10 Additional
- Section 11
- Section 12 Right to
- Section 13 Right of
- Section 14 Right to
- Section 15 Duties of Data
- Section 16
- Section 17
- Section 18 Establishment
- Section 19 Composition
- Section 20 Salary,
- Section 21
- Section 22
- Section 23
- Section 24
- Section 25
- Section 26 Powers of
- Section 27 Powers and
- Section 28 Procedure to
- Section 29
- Section 30 Orders passed
- Section 31 Alternate
- Section 32 Voluntary
- Section 33 Penalties
- Section 34
- Section 35
- Section 36
- Section 37
- Section 38 Consistency
- Section 39 Bar of
- Section 40 Power to
- Section 41
- Section 42
- Section 43
- Section 44 24 of 1997
The Rules
- Rule 1 Short title and commencement
- Rule 2 Definitions
- Rule 3 Notice given by Data Fiduciary to Data Principal
- Rule 4 Registration and obligations of Consent Manager
- Rule 5 Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities
- Rule 6 Reasonable security safeguards
- Rule 7 Intimation of personal data breach
- Rule 8 Time period for specified purpose to be deemed as no longer being served
- Rule 9 Contact information of person to answer questions about processing
- Rule 10 Verifiable consent for processing of personal data of child
- Rule 11 Verifiable consent for processing of personal data of person with disability who has lawful guardian
- Rule 12 Exemptions from certain obligations applicable to processing of personal data of child
- Rule 13 Additional obligations of Significant Data Fiduciary
- Rule 14 Rights of Data Principals
- Rule 15 Transfer of personal data outside the territory of India
- Rule 16 Exemption from Act for research, archiving or statistical purposes
- Rule 17 Appointment of Chairperson and other Members
- Rule 18 Salary, allowances and other terms and conditions of service of Chairperson and other Members
- Rule 19 Procedure for meetings of Board and authentication of its orders, directions and instruments
- Rule 20 Functioning of Board as digital office
- Rule 21 Terms and conditions of appointment and service of officers and employees of Board
- Rule 22 Appeal to Appellate Tribunal
- Rule 23 Calling for information from Data Fiduciary or intermediary