Reference

The Act and Rules, section by section

Every section of the Act and every rule in plain words, with the chapter of the business track that explains it. Use this page to find where a provision is covered.

The Act · Chapter I: Preliminary

s.1Name and start date: The Act starts on dates the Government notifies, and different parts can start on different dates. Chapter 1: The big picture →
s.2Definitions: Defines the key terms: personal data, Data Principal, Data Fiduciary, Data Processor, Consent Manager, child (under 18), personal data breach and others. Chapter 1: The big picture →
s.3Where the Act applies: Digital personal data processed in India, including paper records digitised later, and processing abroad linked to offering goods or services to people in India. Not personal or domestic use, and not data the person made public or that a law requires to be public. Chapter 1: The big picture →

The Act · Chapter II: Obligations of Data Fiduciaries

s.4Grounds for processing: Personal data may be processed only for a lawful purpose, and only with consent or for one of the listed legitimate uses. Chapter 2: Getting permission right →
s.5Notice: Every consent request needs a notice saying what data, for what purpose, how to use rights and how to complain to the Board. People who consented before the Act must be sent a notice too. Available in English or any Eighth Schedule language. Chapter 2: Getting permission right →
s.6Consent: Consent must be free, specific, informed, unconditional and unambiguous, by a clear affirmative action, and limited to necessary data. It can be withdrawn as easily as it was given. The fiduciary must be able to prove notice and consent. Consent Managers are introduced here. Chapter 2: Getting permission right →
s.7Certain legitimate uses: Uses that need no consent: data given voluntarily for a purpose, State benefits and services, functions of the State, legal obligations, court orders, medical emergencies, epidemics, disasters, and employment. Chapter 2: Getting permission right →
s.8General obligations: The fiduciary is responsible even for its processors, must use processors only under a valid contract, keep data accurate where it drives decisions, take reasonable security safeguards, report breaches, erase data when the purpose is over, publish a contact and run a grievance system. Chapter 3: Your everyday duties →
s.9Children's data: Verifiable consent of a parent or lawful guardian is needed for a child or a person with disability who has a guardian. No processing that harms a child's well-being, and no tracking, behavioural monitoring or targeted advertising directed at children, subject to prescribed exemptions. Chapter 5: Children and persons with disability →
s.10Significant Data Fiduciaries: The Government can notify fiduciaries as significant based on volume and sensitivity of data and risk. They must appoint a Data Protection Officer in India and an independent auditor, and carry out impact assessments and audits. Chapter 7: Big players, borders and exceptions →

The Act · Chapter III: Rights and duties of Data Principals

s.11Right of access: A person who gave consent can ask for a summary of their data and the processing, and the identities of others it was shared with. Chapter 6: The rights of the people you serve →
s.12Correction and erasure: The right to have data corrected, completed, updated or erased. Erasure can be refused where the data is still needed for the purpose or must be kept by law. Chapter 6: The rights of the people you serve →
s.13Grievance redressal: People must have a readily available way to raise grievances, and must use it before going to the Board. Chapter 6: The rights of the people you serve →
s.14Nomination: A person can nominate someone to exercise their rights if they die or become incapable. Chapter 6: The rights of the people you serve →
s.15Duties of Data Principals: Follow the law, do not impersonate anyone, do not hide material information for government IDs, do not file false or frivolous complaints, and give only authentic information for corrections. Chapter 6: The rights of the people you serve →

The Act · Chapter IV: Special provisions

s.16Transfers outside India: Transfers are allowed unless the Government restricts a country or territory by notification. Stricter rules in other laws continue to apply. Chapter 7: Big players, borders and exceptions →
s.17Exemptions: Most duties do not apply to enforcing legal claims, courts and regulators, investigating offences, certain offshore contracts, approved mergers and loan-default checks. Notified State bodies and research under prescribed standards are exempt from the Act. The Government may exempt notified fiduciaries, including startups, from some duties. Chapter 7: Big players, borders and exceptions →

The Act · Chapters V to VII: The Board, procedure and appeals

s.18–26Data Protection Board of India: Sets up the Board, its Chairperson and Members, their qualifications, two-year terms, removal, staff and the Chairperson's powers. Chapter 8: Enforcement and your action plan →
s.27Powers and functions: The Board acts on breach intimations, complaints from Data Principals, references from Governments and court directions. It can direct urgent remedial measures, inquire and impose penalties. Chapter 8: Enforcement and your action plan →
s.28Procedure: The Board works as a digital office, decides whether there are grounds to inquire, follows natural justice, has civil-court powers to summon and inspect, and can warn or impose costs for false or frivolous complaints. Chapter 8: Enforcement and your action plan →
s.29–30Appeals: Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days. Its orders are enforceable like a civil court decree. Chapter 6: The rights of the people you serve →
s.31Mediation: The Board can direct the parties to try to resolve a complaint through mediation. Chapter 8: Enforcement and your action plan →
s.32Voluntary undertaking: The Board can accept an undertaking to take or stop an action. It bars further proceedings on that matter unless the undertaking is broken. Chapter 8: Enforcement and your action plan →

The Act · Chapters VIII and IX: Penalties and miscellaneous

s.33Penalties: If a breach is significant, the Board can impose a penalty from the Schedule after a hearing. It must weigh gravity, duration, type of data, repetition, gain or loss, mitigation, proportionality and the impact of the penalty. Chapter 8: Enforcement and your action plan →
s.34Where penalties go: Penalties are credited to the Consolidated Fund of India. Chapter 8: Enforcement and your action plan →
s.35–36Good-faith protection and information: Protects the Government and the Board for actions in good faith, and lets the Government call for information from the Board, fiduciaries and intermediaries. Chapter 8: Enforcement and your action plan →
s.37Blocking: After penalties in two or more instances, and on the Board's advice, the Government can direct that a fiduciary's service be blocked in the public interest, after a hearing. Chapter 8: Enforcement and your action plan →
s.38–39Other laws and courts: The Act adds to other laws and prevails where there is a conflict. Civil courts cannot hear matters the Board is empowered to decide. Chapter 8: Enforcement and your action plan →
s.40–43Rules, Schedule and difficulties: Powers to make rules, to amend the penalty Schedule (never more than doubling a penalty), and to remove difficulties within three years of commencement. Chapter 1: The big picture →
s.44Amendments to other Acts: Removes section 43A of the IT Act, and changes section 8(1)(j) of the Right to Information Act to cover information which relates to personal information. Chapter 1: The big picture →
SchedulePenalties: Up to ₹250 crore for failing to take reasonable security safeguards; ₹200 crore for failing to notify a breach or for breaching children's-data duties; ₹150 crore for Significant Data Fiduciary duties; ₹10,000 for breach of Data Principal duties; ₹50 crore for any other breach. Chapter 8: Enforcement and your action plan →

The Rules, 2025

Rule 1–2Commencement and definitions: Rules 1, 2 and 17 to 21 started on publication in November 2025. Rule 4 starts one year later, and Rules 3, 5 to 16, 22 and 23 start eighteen months after publication. Chapter 1: The big picture →
Rule 3Notice: The notice must stand on its own, use clear and plain language, itemise the personal data, state the purposes and the goods, services or uses enabled, and give the link to withdraw consent, use rights and complain to the Board. Chapter 2: Getting permission right →
Rule 4Consent Managers: Registration with the Board and the obligations of Consent Managers, set out in the First Schedule. Chapter 2: Getting permission right →
Rule 5State benefits and services: Standards for the State processing personal data to provide subsidies, benefits, services, certificates, licences and permits, set out in the Second Schedule. Chapter 2: Getting permission right →
Rule 6Reasonable security safeguards: Minimum safeguards: encryption, masking or similar measures, access control, logs and monitoring, backups, one-year retention of logs, security terms in processor contracts, and technical and organisational measures. Chapter 3: Your everyday duties →
Rule 7Breach intimation: Tell each affected person without delay in plain language. Tell the Board without delay, then give detailed information within 72 hours, or a longer period the Board allows. Chapter 4: When something goes wrong →
Rule 8Retention and erasure: Large e-commerce, gaming and social media platforms must erase data after three years of inactivity, with 48 hours' warning. All fiduciaries keep personal data, traffic data and logs for at least one year for Seventh Schedule purposes. Chapter 3: Your everyday duties →
Rule 9Contact information: Prominently publish the contact of the Data Protection Officer, or of a person who can answer questions about processing, and include it in every reply to a rights request. Chapter 3: Your everyday duties →
Rule 10Verifiable parental consent: Take due care that the person giving consent for a child is an identifiable adult, using details already held, details the parent provides, or a virtual token such as one from a Digital Locker service provider. Chapter 5: Children and persons with disability →
Rule 11Guardians of persons with disability: Verify that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law. Chapter 5: Children and persons with disability →
Rule 12Exemptions for children's data: Parental consent and the tracking ban do not apply to the classes of fiduciaries and the purposes in the Fourth Schedule, within the stated conditions. Chapter 5: Children and persons with disability →
Rule 13Significant Data Fiduciaries: An impact assessment and audit every twelve months, a report of significant observations to the Board, due diligence on algorithmic software, and keeping Government-specified data within India. Chapter 7: Big players, borders and exceptions →
Rule 14Rights of Data Principals: Publish how to make rights requests and what identifier is needed. Publish a grievance response period of no more than ninety days. People may nominate one or more individuals. Chapter 6: The rights of the people you serve →
Rule 15Transfers outside India: Transfers are allowed subject to any requirements the Government specifies about making data available to a foreign State or its agencies. Chapter 7: Big players, borders and exceptions →
Rule 16Research, archiving and statistics: The Act does not apply to processing necessary for these purposes if the Second Schedule standards are followed. Chapter 7: Big players, borders and exceptions →
Rule 17–21The Board: Selection committees for the Chairperson and Members, their service conditions, meeting procedure, a six-month period for inquiries (extendable three months at a time), the digital office, and Board staff. Chapter 8: Enforcement and your action plan →
Rule 22Appeals: Appeals to the Appellate Tribunal are filed digitally with a fee, and the Tribunal works as a digital office. Chapter 8: Enforcement and your action plan →
Rule 23Calling for information: The Government can require fiduciaries and intermediaries to furnish information for Seventh Schedule purposes, and can bar disclosure of that fact where national security is involved. Chapter 8: Enforcement and your action plan →

Schedules to the Rules

FirstConsent Managers: Conditions for registration (an Indian company with net worth of at least ₹2 crore, independent certification) and obligations (cannot read the data, keeps records for seven years, no conflict of interest, no sub-contracting). Chapter 2: Getting permission right →
SecondStandards for State processing and research: Lawful, limited to what is necessary, reasonably accurate, retained only as long as needed, secured, and accountable. Chapter 7: Big players, borders and exceptions →
ThirdThree-year erasure: Applies to e-commerce entities and social media intermediaries with two crore or more registered users in India, and online gaming intermediaries with fifty lakh or more. Chapter 3: Your everyday duties →
FourthChildren's data exemptions: Part A: health establishments and professionals, educational institutions, crèches and day care, and their transport providers. Part B: purposes such as legal duties in a child's interest, State benefits, email accounts, real-time location for safety, blocking harmful content and age confirmation. Chapter 5: Children and persons with disability →
Fifth and SixthBoard service conditions: Salary, allowances and terms of service for the Chairperson, Members, officers and employees of the Board. Chapter 8: Enforcement and your action plan →
SeventhGovernment information requests: The purposes for which, and the authorised persons through whom, the Government can call for information. Chapter 3: Your everyday duties →