The Digital Personal Data Protection Act, 2023

Compliance Rules

28 rules

Data Principal - The individual to whom the personal data re…

1 trigger · 7 rules

Data Fiduciary - Any person who alone or with others determi…

1 trigger · 9 rules

Significant Data Fiduciary (SDF) - A Data Fiduciary notified…

1 trigger · 3 rules

Consent Manager - A person registered with the Board who ena…

1 trigger · 1 rules

Data Processor - Any person who processes personal data on b…

1 trigger · 2 rules

Data Protection Officer (DPO) - An India-based officer appoi…

1 trigger · 2 rules

Data Protection Board of India - The regulator established u…

1 trigger · 4 rules

Rules & Subordinate Legislation

187 rules

Made under this Act

Statutory instruments & rules issued under its authority

1. Short title and commencement
This Act may be called the Digital Personal Data Protection Act, 2023, and comes into force on such date(s) as the Central Government may, by notification, appoint.
Section 1
2. Definitions
DPDP-DPR-POB-1 (Processor): Enter into a valid contract with the Data Fiduciary before any processing. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-2 (Processor): Process personal data only on the documented instructions and specified purpose of the Data Fiduciary. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-3 (Processor): Apply reasonable technical and organizational security safeguards. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-4 (Processor): Assist the Data Fiduciary in responding to Data Principal access/correction/erasure requests. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-5 (Processor): Detect and notify the Data Fiduciary of any personal data breach without delay. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-6 (Processor): Erase or return personal data on instruction or when the purpose is served. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
2. Definitions
DPDP-DPR-POB-7 (Processor): Maintain processing records and enable the Data Fiduciary’s audits and inspections. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 2
3. Application of Act
Applies to the processing of digital personal data within India, and to processing outside India where it is in connection with offering goods or services to Data Principals in India. Excludes personal/domestic processing and personal data made publicly available by the Data Principal or under a legal obligation.
Section 3
4. Grounds for processing personal data
Establish a lawful basis (consent or a legitimate use under s.7) before any processing.
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-1 (Fiduciary): Define specified purpose and lawful basis. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-2 (Fiduciary): Prepare notice (data, purpose, rights, grievance details). Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-3 (Fiduciary): Present consent request with clear affirmative action. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-4 (Fiduciary): Capture and store consent records. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-5 (Fiduciary): Enable multilingual notice access. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
4. Grounds for processing personal data
DPDP-DF-DCO-6 (Fiduciary): Allow withdrawal via comparable ease mechanism. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 4
5. Notice
Serve a clear, plain-language consent notice (itemising data, purpose, rights and grievance route) before or at the time of consent. [DPDP Rules, 2025 - Rule 3]
Rule under Section 5
5. Notice
DPDP-DP-CL-1 (Principal): Receive notice from Data Fiduciary (purpose, data types, rights, grievance mechanism). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-2 (Principal): Review consent request in clear language. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-3 (Principal): Provide clear affirmative consent (or decline). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-4 (Principal): Data processing begins for specified purpose. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-5 (Principal): Access / review personal data and processing summary. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-6 (Principal): Withdraw consent (ease comparable to giving consent). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DP-CL-7 (Principal): Processing stops unless lawful basis applies; data erased when purpose complete. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-1 (Fiduciary): Define specified purpose and lawful basis. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-2 (Fiduciary): Prepare notice (data, purpose, rights, grievance details). Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-3 (Fiduciary): Present consent request with clear affirmative action. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-4 (Fiduciary): Capture and store consent records. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-5 (Fiduciary): Enable multilingual notice access. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
5. Notice
DPDP-DF-DCO-6 (Fiduciary): Allow withdrawal via comparable ease mechanism. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 5
6. Consent
Obtain valid consent; record it; enable withdrawal as easily as it was given; where used, route via a registered Consent Manager.
Rule under Section 6
6. Consent
DPDP-DP-CL-1 (Principal): Receive notice from Data Fiduciary (purpose, data types, rights, grievance mechanism). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-2 (Principal): Review consent request in clear language. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-3 (Principal): Provide clear affirmative consent (or decline). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-4 (Principal): Data processing begins for specified purpose. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-5 (Principal): Access / review personal data and processing summary. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-6 (Principal): Withdraw consent (ease comparable to giving consent). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DP-CL-7 (Principal): Processing stops unless lawful basis applies; data erased when purpose complete. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-1 (Fiduciary): Define specified purpose and lawful basis. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-2 (Fiduciary): Prepare notice (data, purpose, rights, grievance details). Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-3 (Fiduciary): Present consent request with clear affirmative action. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-4 (Fiduciary): Capture and store consent records. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-5 (Fiduciary): Enable multilingual notice access. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-DF-DCO-6 (Fiduciary): Allow withdrawal via comparable ease mechanism. Penalty: Up to Rs.50 crore — Breach of lawful-basis, notice or consent obligations (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-1 (ConsentManager): Receive consent request from Data Fiduciary. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-2 (ConsentManager): Display consent options transparently to Data Principal. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-3 (ConsentManager): Capture give/manage/review/withdraw actions. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-4 (ConsentManager): Maintain interoperable consent records. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-5 (ConsentManager): Relay consent status updates to Data Fiduciary. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
6. Consent
DPDP-CM-CO-6 (ConsentManager): Support grievance handling related to consent operations. Penalty: Up to Rs.50 crore — Breach by Consent Manager of its obligations to Data Principal/Board (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 6
7. Certain legitimate uses
Where relying on a legitimate use, process only for that use and within its limits.
Rule under Section 7
8. General obligations of Data Fiduciary
Maintain reasonable security safeguards [DPDP Rules, 2025 - Rule 7]; on a breach, remediate and document the root cause and give intimation to the Board/principals [Rule 8]; erase data when consent is withdrawn or the purpose is served; publish DPO/contact details; contract with processors.
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-1 (Principal): Receive notice from Data Fiduciary (purpose, data types, rights, grievance mechanism). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-2 (Principal): Review consent request in clear language. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-3 (Principal): Provide clear affirmative consent (or decline). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-4 (Principal): Data processing begins for specified purpose. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-5 (Principal): Access / review personal data and processing summary. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-6 (Principal): Withdraw consent (ease comparable to giving consent). Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DP-CL-7 (Principal): Processing stops unless lawful basis applies; data erased when purpose complete. Penalty: Up to Rs.50 crore — Breach of notice/consent obligations behind this journey (residuary breach by the Data Fiduciary) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-1 (Fiduciary): Collect minimum necessary personal data. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-2 (Fiduciary): Validate consent status or legitimate use. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-3 (Fiduciary): Process data for specified purpose. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-4 (Fiduciary): Ensure data completeness, accuracy and consistency where decisions/ sharing occur. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-5 (Fiduciary): Apply technical and organizational safeguards. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-PDQ-6 (Fiduciary): Maintain processing logs and controls. Penalty: Up to Rs.250 crore — Failure to take reasonable security safeguards (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-DSP-1 (Fiduciary): Assess sharing necessity and legal basis. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-DSP-2 (Fiduciary): Verify recipient and contractual controls. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-DSP-3 (Fiduciary): Share data with logging and purpose limitation. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-DSP-4 (Fiduciary): Track identities of recipients for disclosure to Data Principal upon request. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-DSP-5 (Fiduciary): Monitor processor compliance. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-1 (Fiduciary): Detect or receive alert of personal data breach. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-2 (Fiduciary): Assess scope and impact. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-3 (Fiduciary): Initiate containment and mitigation actions. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-4 (Fiduciary): Notify Data Protection Board. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-5 (Fiduciary): Notify affected Data Principals. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-6 (Fiduciary): Document incident and remediation. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-BM-7 (Fiduciary): Implement corrective controls. Penalty: Up to Rs.200 crore — Failure to give intimation of a personal data breach (Schedule, entry 2 (Sec 8(6)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-RET-1 (Fiduciary): Monitor purpose completion / inactivity. Penalty: Up to Rs.50 crore — Failure to erase data when consent withdrawn or purpose served (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-RET-2 (Fiduciary): Check legal retention requirements. Penalty: Up to Rs.50 crore — Failure to erase data when consent withdrawn or purpose served (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-RET-3 (Fiduciary): Erase data when consent withdrawn or purpose no longer served. Penalty: Up to Rs.50 crore — Failure to erase data when consent withdrawn or purpose served (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-RET-4 (Fiduciary): Instruct processors to erase data. Penalty: Up to Rs.50 crore — Failure to erase data when consent withdrawn or purpose served (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DF-RET-5 (Fiduciary): Record erasure completion. Penalty: Up to Rs.50 crore — Failure to erase data when consent withdrawn or purpose served (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-1 (Processor): Enter into a valid contract with the Data Fiduciary before any processing. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-2 (Processor): Process personal data only on the documented instructions and specified purpose of the Data Fiduciary. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-3 (Processor): Apply reasonable technical and organizational security safeguards. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-4 (Processor): Assist the Data Fiduciary in responding to Data Principal access/correction/erasure requests. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-5 (Processor): Detect and notify the Data Fiduciary of any personal data breach without delay. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-6 (Processor): Erase or return personal data on instruction or when the purpose is served. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
8. General obligations of Data Fiduciary
DPDP-DPR-POB-7 (Processor): Maintain processing records and enable the Data Fiduciary’s audits and inspections. Penalty: Up to Rs.250 crore — Security failure attributable to the processor (liability flows to the Data Fiduciary under Sec 8(5); recoverable via the processing contract) (Schedule, entry 1 (Sec 8(5)))
Rule under Section 8
9. Processing of personal data of children
Detect if the user is a child; obtain verifiable parental/guardian consent [DPDP Rules, 2025 - Rule 10]; block tracking, behavioural monitoring and targeted advertising for children.
Rule under Section 9
9. Processing of personal data of children
DPDP-DF-CDP-1 (Fiduciary): Determine if user is a child. Penalty: Up to Rs.200 crore — Breach of additional obligations in relation to children (Schedule, entry 3 (Sec 9))
Rule under Section 9
9. Processing of personal data of children
DPDP-DF-CDP-2 (Fiduciary): Obtain verifiable parental/guardian consent. Penalty: Up to Rs.200 crore — Breach of additional obligations in relation to children (Schedule, entry 3 (Sec 9))
Rule under Section 9
9. Processing of personal data of children
DPDP-DF-CDP-3 (Fiduciary): Block tracking/behavioral monitoring and targeted ads for children. Penalty: Up to Rs.200 crore — Breach of additional obligations in relation to children (Schedule, entry 3 (Sec 9))
Rule under Section 9
9. Processing of personal data of children
DPDP-DF-CDP-4 (Fiduciary): Ensure processing avoids detrimental impact. Penalty: Up to Rs.200 crore — Breach of additional obligations in relation to children (Schedule, entry 3 (Sec 9))
Rule under Section 9
9. Processing of personal data of children
DPDP-DF-CDP-5 (Fiduciary): Apply exemptions only if notified conditions met. Penalty: Up to Rs.200 crore — Breach of additional obligations in relation to children (Schedule, entry 3 (Sec 9))
Rule under Section 9
10. Additional obligations of Significant Data Fiduciary
Appoint an India-based DPO; appoint an independent data auditor; conduct periodic DPIA and audit; report and govern via board-level oversight [DPDP Rules, 2025 - Rule 13].
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-1 (SDF): Appoint Data Protection Officer (India-based). Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-2 (SDF): Appoint independent data auditor. Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-3 (SDF): Conduct periodic Data Protection Impact Assessment. Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-4 (SDF): Run periodic compliance audits. Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-5 (SDF): Report and govern via board-level oversight. Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
10. Additional obligations of Significant Data Fiduciary
DPDP-SDF-ECP-6 (SDF): Maintain grievance and regulator interface. Penalty: Up to Rs.150 crore — Breach of additional obligations of a Significant Data Fiduciary (Schedule, entry 4 (Sec 10))
Rule under Section 10
11. Right to access information about personal data
On a valid request, provide the access summary within the prescribed time.
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-1 (Principal): Authenticate identity and submit request. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-2 (Principal): Select right: access, correction, completion, update, or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-3 (Principal): Data Fiduciary validates request and applicability. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-4 (Principal): Data Fiduciary provides summary / performs correction or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-5 (Principal): User receives confirmation and outcome. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-6 (Principal): Escalate grievance if unsatisfied. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DP-RE-7 (Principal): Approach Data Protection Board after exhausting fiduciary grievance mechanism. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 11
11. Right to access information about personal data
DPDP-DF-DSP-1 (Fiduciary): Assess sharing necessity and legal basis. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 11
11. Right to access information about personal data
DPDP-DF-DSP-2 (Fiduciary): Verify recipient and contractual controls. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 11
11. Right to access information about personal data
DPDP-DF-DSP-3 (Fiduciary): Share data with logging and purpose limitation. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 11
11. Right to access information about personal data
DPDP-DF-DSP-4 (Fiduciary): Track identities of recipients for disclosure to Data Principal upon request. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 11
11. Right to access information about personal data
DPDP-DF-DSP-5 (Fiduciary): Monitor processor compliance. Penalty: Up to Rs.250 crore — Failure to safeguard data shared with/processed by processors (Schedule, entry 1 (Sec 8(5)))
Rule under Section 11
12. Right to correction and erasure of personal data
On a valid request, correct/complete/update or erase the data unless legally required to retain.
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-1 (Principal): Authenticate identity and submit request. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-2 (Principal): Select right: access, correction, completion, update, or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-3 (Principal): Data Fiduciary validates request and applicability. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-4 (Principal): Data Fiduciary provides summary / performs correction or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-5 (Principal): User receives confirmation and outcome. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-6 (Principal): Escalate grievance if unsatisfied. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
12. Right to correction and erasure of personal data
DPDP-DP-RE-7 (Principal): Approach Data Protection Board after exhausting fiduciary grievance mechanism. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 12
13. Right of grievance redressal
Provide an accessible grievance mechanism and respond within the prescribed period.
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-1 (Principal): Authenticate identity and submit request. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-2 (Principal): Select right: access, correction, completion, update, or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-3 (Principal): Data Fiduciary validates request and applicability. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-4 (Principal): Data Fiduciary provides summary / performs correction or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-5 (Principal): User receives confirmation and outcome. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-6 (Principal): Escalate grievance if unsatisfied. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
13. Right of grievance redressal
DPDP-DP-RE-7 (Principal): Approach Data Protection Board after exhausting fiduciary grievance mechanism. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 13
14. Right to nominate
Enable nomination of another individual to exercise rights.
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-1 (Principal): Authenticate identity and submit request. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-2 (Principal): Select right: access, correction, completion, update, or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-3 (Principal): Data Fiduciary validates request and applicability. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-4 (Principal): Data Fiduciary provides summary / performs correction or erasure. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-5 (Principal): User receives confirmation and outcome. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-6 (Principal): Escalate grievance if unsatisfied. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
14. Right to nominate
DPDP-DP-RE-7 (Principal): Approach Data Protection Board after exhausting fiduciary grievance mechanism. Penalty: Up to Rs.50 crore — Fiduciary failure to honour Data Principal rights (residuary breach) (Schedule, entry 6 (residuary "any other" breach))
Rule under Section 14
15. Duties of Data Principal
Furnish authentic information; do not file false or frivolous complaints.
Rule under Section 15
16. Processing of personal data outside India
Comply with any restriction notified on cross-border transfer.
Rule under Section 16
17. Exemptions
Provides exemptions from specified provisions - e.g. for enforcement of legal rights, judicial/regulatory functions, prevention/investigation of offences, and processing by notified instrumentalities of the State in the interests of sovereignty, security, public order, etc.
Section 17
18. Establishment of Board
The Central Government shall establish the Data Protection Board of India.
Section 18
19. Composition and qualifications for appointment of Chairperson and Members
Provides for the composition of the Board and the qualifications for appointment of its Chairperson and Members.
Section 19
20. Salary, allowances payable to and term of office
Provides for the salary, allowances and term of office of the Chairperson and Members.
Section 20
21. Disqualifications for appointment and continuation as Chairperson and Members of Board
Sets out the disqualifications for appointment and for continuation as Chairperson or Member.
Section 21
22. Resignation by Members and filling of vacancy
Provides for resignation by Members and the filling of vacancies.
Section 22
23. Proceedings of Board
Provides for the conduct and authentication of the proceedings of the Board.
Section 23
24. Officers and employees of Board
Provides for the officers and employees of the Board.
Section 24
25. Members and officers to be public servants
Members and officers of the Board are deemed public servants.
Section 25
26. Powers of Chairperson
Provides for the powers of the Chairperson over the general superintendence and management of the Board.
Section 26
27. Powers and functions of Board
(Board) Receive complaints/breach intimations; inquire; direct remediation; impose penalties.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-1 (Board): Receive complaint, breach intimation, or government reference. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-2 (Board): Determine whether sufficient grounds exist. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-3 (Board): Initiate inquiry and provide hearing opportunity. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-4 (Board): Issue directions or interim orders if required. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-5 (Board): Conclude inquiry and impose penalty or close proceedings. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
27. Powers and functions of Board
DPDP-DPB-CBI-6 (Board): Allow appeal to Appellate Tribunal. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 27
28. Procedure to be followed by Board
(Board) Follow natural justice; observe the prescribed procedure.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-1 (Board): Receive complaint, breach intimation, or government reference. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-2 (Board): Determine whether sufficient grounds exist. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-3 (Board): Initiate inquiry and provide hearing opportunity. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-4 (Board): Issue directions or interim orders if required. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-5 (Board): Conclude inquiry and impose penalty or close proceedings. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
28. Procedure to be followed by Board
DPDP-DPB-CBI-6 (Board): Allow appeal to Appellate Tribunal. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 28
29. Appeal to Appellate Tribunal
File any appeal to TDSAT within the prescribed period and manner.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-1 (Board): Receive complaint, breach intimation, or government reference. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-2 (Board): Determine whether sufficient grounds exist. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-3 (Board): Initiate inquiry and provide hearing opportunity. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-4 (Board): Issue directions or interim orders if required. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-5 (Board): Conclude inquiry and impose penalty or close proceedings. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
29. Appeal to Appellate Tribunal
DPDP-DPB-CBI-6 (Board): Allow appeal to Appellate Tribunal. Breach: Not applicable — the Data Protection Board is the adjudicating authority, not a regulated party.
Rule under Section 29
30. Orders passed by Appellate Tribunal to be executable as decree
Orders of the Appellate Tribunal are executable as a decree of a civil court.
Section 30
31. Alternate dispute resolution
The Board may direct the parties to attempt resolution of a complaint through mediation or other alternate dispute resolution.
Section 31
32. Voluntary undertaking
Comply with the terms of any voluntary undertaking accepted by the Board.
Rule under Section 32
33. Penalties
(Board) Impose penalties per the Schedule; the amounts appear on the Penalties tab.
Rule under Section 33
34. Crediting sums realised by way of penalties to Consolidated Fund of India
Sums realised as penalties are credited to the Consolidated Fund of India.
Section 34
35. Protection of action taken in good faith
Protects the Central Government, the Board, its Chairperson, Members, officers and employees for acts done in good faith.
Section 35
36. Power to call for information
Empowers the Central Government/Board to call for information from a Data Fiduciary or intermediary.
Section 36
37. Power of Central Government to issue directions
Empowers the Central Government to issue directions, including to block information in the interest of the general public on a reference from the Board.
Section 37
38. Consistency with other laws
The Act has effect in addition to and not in derogation of other laws; in case of conflict on data protection, this Act generally prevails.
Section 38
39. Bar of jurisdiction
No civil court has jurisdiction over any matter which the Board or the Appellate Tribunal is empowered to determine.
Section 39
40. Power to make rules
Comply with the Digital Personal Data Protection Rules, 2025 made under this section.
Rule under Section 40
41. Laying of rules and certain notifications
Rules and certain notifications must be laid before each House of Parliament.
Section 41
42. Power to amend Schedule
Empowers the Central Government to amend the Schedule (penalty amounts), subject to a cap.
Section 42
43. Power to remove difficulties
Empowers the Central Government to issue orders to remove difficulties in giving effect to the Act, within a limited period.
Section 43
44. Amendments to certain Acts
Note: data-protection compensation earlier under s.43A of the IT Act is now governed by this Act.
Rule under Section 44

Consumable API

Versioned JSON endpoints. Read access is open; write/usage needs a key.

cURL

JavaScript

Python

# Fetch the full law as JSON
curl https://lawascode.negd.in/laac-api/v1/laws/the-digital-personal-data-protection-act-2023

# Just the penalty schedule
curl https://lawascode.negd.in/laac-api/v1/laws/the-digital-personal-data-protection-act-2023/penalties

# A specific provision
curl https://lawascode.negd.in/laac-api/v1/laws/the-digital-personal-data-protection-act-2023/provisions/1