Why self-serve Proof DPDP News Blog Support Contact | Academy Sign In
Home / DPDP Act

The DPDP Act, section by section.

All 44 sections of the Digital Personal Data Protection Act, 2023, in the language of a practitioner. What each section says. What it means for your programme. What to do about it. Sourced from the Act text and the DPDP Rules 2025 notification of 14 November 2025.

Not legal advice. Read the Act text alongside. Escalate to counsel where the stakes are material.

Preliminary (3)

Section 1
Short title and commencement
Names the Act and delegates its start date to the Central Government. Different sections can commence on different dates. In practice, DP...
Section 2
Definitions
Defines the terms the Act uses: personal data, data principal, data fiduciary, data processor, consent manager, Board, and more. Every le...
Section 3
Application of the Act
The Act applies to digital personal data processed in India, and to offshore processing that offers goods or services to data principals ...

Obligations (7)

Section 4
Grounds for processing
Two lawful grounds only: consent under Section 6, or one of the certain legitimate uses under Section 7. No general 'legitimate interest'...
Section 5
Notice
Before or at the time of asking for consent, the Data Fiduciary must give a plain-language notice listing the personal data collected, th...
Section 6
Consent
Consent must be free, specific, informed, unconditional, unambiguous, and given by clear affirmative action. Limited to data necessary fo...
Section 7
Certain legitimate uses
Six situations where consent is not required: voluntary provision (7a), performance of law (7b), medical emergency (7c), employment (7d),...
Section 8
General obligations of Data Fiduciary
The core operational obligations: accountability (8.1), accuracy (8.3), security safeguards (8.4-8.5), breach notification (8.6), erasure...
Section 9
Children's data
Verifiable parental consent for anyone under 18. No behavioural monitoring or targeted advertising directed at children, with no 'with co...
Section 10
Additional obligations for Significant Data Fiduciaries
Once notified as an SDF, extra obligations: appoint an India-based DPO (10.2.a), independent audit (10.2.b), and DPIA + audit report to t...

Rights (5)

Section 11
Right to access information
Data principal can ask for a summary of their personal data, the processing activities, and the identities of Data Fiduciaries and Proces...
Section 12
Right to correction and erasure
Right to have inaccurate data corrected, incomplete data completed, or personal data erased. Erasure can be refused where retention is re...
Section 13
Right to grievance redressal
Data principal must first approach the Data Fiduciary's grievance officer. If unresolved, escalate to the Data Protection Board.
Section 14
Right to nominate
Data principal can nominate another individual to exercise rights on their behalf in the event of death or incapacity.
Section 15
Duties of Data Principal
Data principal must comply with the law, provide accurate information for identity verification, and not file frivolous complaints. Furni...

Cross-border (1)

Section 16
Cross-border transfer of personal data
The Central Government may restrict transfers to specified countries by notification. Default position: transfers are permitted unless re...

Exemptions (1)

Section 17
Exemptions
Broad exemptions for state security, sovereignty, public order, prevention of offences, research (with conditions), and some legal claims...

Government (1)

Section 18
Powers of the Central Government
Section 18 gives the Government power to exempt specific entities or classes for a period. Section 42 (Rules) gives it the power to make ...

Board (8)

Section 19
Establishment of the Data Protection Board
The Board is India's DPDP regulator. Constituted by the Central Government. Digital-office by design. Independent in function.
Section 20
Composition and qualifications
Chairperson and Members appointed by the Central Government. Terms and qualifications defined by Rules.
Section 21
Salary, allowances and conditions
Administrative provisions on Board members' service conditions.
Section 22
Disqualifications
Grounds on which a Chairperson or Member ceases to hold office.
Section 23
Resignation and vacancy
Process for resignation and filling vacancies.
Section 24
Chief Executive Officer
The Board has a CEO who runs its day-to-day operations.
Section 25
Officers and employees
The Board can appoint officers and employees.
Section 26
Meetings, procedure
The Board is a digital office. Meetings can be held by video. Procedure is prescribed by Regulations.

Enforcement (11)

Section 27
Powers and functions of the Board
The Board can inquire into breaches, direct urgent remedial or mitigatory measures, and impose penalties per the Schedule. It can also re...
Section 28
Procedure of the Board
The Board hears matters, records reasons, and passes orders. Natural justice principles apply.
Section 29
Appeal
Appeal from a Board order lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Further appeal to the Supreme Court on ...
Section 30
Orders of the Board
Orders are digitally issued. They can be published. Compliance is mandatory.
Section 31
Alternate dispute resolution
The Board may refer a matter for mediation or other dispute resolution.
Section 32
Voluntary undertaking
A Data Fiduciary may offer a voluntary undertaking. Acceptance can bar further proceedings on that matter.
Section 33
Penalty
Penalty per the Schedule. Section 33(2) requires the Board to consider mitigation steps you took when deciding the amount.
Section 34
Application of amounts
Penalties are credited to the Consolidated Fund of India.
Section 35
Bar of jurisdiction
No civil court has jurisdiction over matters the Board is empowered to decide.
Section 36
Call for information
The Central Government or Board can call for information from any Data Fiduciary, Processor, or intermediary.
Section 37
Power to issue directions
The Central Government can direct blocking of information in the interest of public.

Miscellaneous (7)

Section 38
Consistency with other laws
DPDP is in addition to, not in derogation of, other laws. Where a specific sectoral law is stricter, that governs.
Section 39
Protection of action taken in good faith
No suit against the Central Government, Board, Chairperson, Members, officers or employees for acts done in good faith.
Section 40
Power to make Rules
The Central Government may make Rules. Rules were notified on 14 November 2025 as the DPDP Rules 2025.
Section 41
Power to make Regulations
The Board may make Regulations on its procedure.
Section 42
Laying of Rules and Regulations
Rules and Regulations must be laid before Parliament.
Section 43
Power to remove difficulties
The Government can issue Removal of Difficulties orders within three years of commencement.
Section 44
Repeal, amendment and savings
Section 43A of the IT Act (which previously governed sensitive personal data) is omitted. IT Act amendments to align with DPDP. Savings f...

How to use these pages

Every section page has three parts. First, a plain-English summary of what the section says. Second, our take on what it actually means for a compliance programme. Third, related sections and the DPDP Rules 2025 provisions that operationalise it.

What is missing here

The full verbatim Act text. That lives on MeitY's own PDF and there is no point duplicating it. Read the Act alongside these pages when the stakes are material.

Section text is one thing. Running a programme is another.

dcomply operationalises DPDP end-to-end. Consent, DSR, DPIA, SDF, RoPA, retention, cross-border, breach, everything.

See the platform