The DPDP Act 2023

The Digital Personal Data Protection Act 2023 is India's first horizontal data protection statute. Eight chapters, 44 sections. Some sections are self-contained. Most only make sense once you read the corresponding rule in DPDP Rules 2025 alongside them, so the table below links out to both wherever it helps.

01Chapter I. Preliminary (Sec. 1 to 3)

Sec.	Heading	Deep page
1	Short title, extent and commencement.	—
2	Definitions. Data Fiduciary, Data Principal, Consent Manager, Significant Data Fiduciary, and 34 other terms.	Glossary
3	Application of the Act. Digital personal data of individuals in India, including foreign entities offering goods or services.	—

02Chapter II. Obligations of Data Fiduciary (Sec. 4 to 10)

Sec.	Heading	Deep page
4	Grounds for processing personal data. Consent and legitimate uses.	—
5	Notice to be given to Data Principal before or when consent is sought. Rule 3 sets the notice format.	—
6	Consent. Free, specific, informed, unconditional, unambiguous. Withdrawal must be as easy as giving.	Sec. 6
7	Certain legitimate uses. State functions, medical emergencies, court orders, employment, disaster response.	—
8	General obligations of Data Fiduciary. Accuracy, security safeguards, breach notification, retention limits.	Sec. 8
9	Processing of personal data of children. Verifiable parental consent. No behavioural monitoring or targeted advertising.	Sec. 9
10	Additional obligations of Significant Data Fiduciary.	Sec. 10

03Chapter III. Rights and duties of Data Principal (Sec. 11 to 15)

Sec.	Heading	Deep page
11	Right to information about personal data. Access to a summary of your data being processed.	Sec. 11 to 14
12	Right to correction and erasure of personal data.
13	Right of grievance redressal. First layer is the Data Fiduciary, then the Board.
14	Right to nominate. Designate a person to exercise your rights after death or incapacity.
15	Duties of the Data Principal. Do not file frivolous complaints or false information.	—

04Chapter IV. Special provisions (Sec. 16 to 17)

Sec.	Heading	Deep page
16	Processing outside India. Negative-list transfer model. Central Government may restrict specific countries.	Sec. 16
17	Exemptions. State, research, archival, statistical, court orders, prevention and investigation of offences.	—

05Chapter V. Data Protection Board of India (Sec. 18 to 26)

Sec.	Heading	Deep page
18	Establishment of Board. Data Protection Board of India constituted by Central Government.	Board
19	Composition and qualifications. Chairperson and four Members.
20	Salary, allowances and other terms.
21	Disqualifications and resignation.
22	Officers and employees of the Board.
23	Meetings of the Board and quorum.
24	Authentication of Board orders.
25	Members not to hold office of profit.
26	Chairperson's discretion on procedural matters.

06Chapter VI. Powers, functions and procedure of Board (Sec. 27 to 32)

Sec.	Heading	Deep page
27	Powers and functions of Board. Inquiry on complaints or on its own motion.	Board
28	Procedure of Board. Powers of a civil court, digital-by-design proceedings.
29	Appeal to Appellate Tribunal. Appeals go to TDSAT within 60 days.
30	Orders of Appellate Tribunal.
31	Alternative dispute resolution. Board may direct mediation.
32	Voluntary undertaking. Board may accept an undertaking in lieu of proceedings.

07Chapter VII. Penalties and adjudication (Sec. 33 to 35)

Sec.	Heading	Deep page
33	Penalties. Read with the Schedule to the Act. Four caps up to Rs. 250 crore.	Penalties
34	Credit of sums realised. Penalties credited to the Consolidated Fund of India.	—
35	Previous sanction for cognisance. Court cannot take cognisance of an offence except on Board's complaint.	—

08Chapter VIII. Miscellaneous (Sec. 36 to 44)

Sec.	Heading	Deep page
36	Call for information from Board.	—
37	Central Government power to issue directions.	—
38	Consistency with other laws. DPDP prevails on data protection specifically.	—
39	Protection of action taken in good faith.	—
40	Power of Central Government to make rules. The source of the DPDP Rules 2025.	Rules 2025
41	Power of Board to make regulations.	—
42	Laying of Rules and regulations before Parliament.	—
43	Power to remove difficulties. Time-limited executive fix for teething problems.	—
44	Amendments to other Acts. RTI Act Section 8(1)(j) amended.	—