Digital Personal Data Protection Act, 2023

Mapping of Sections of DPDPA to DPDP Rules 2025

The Digital Personal Data Protection Act, 2023 (DPDPA) and its corresponding Digital Personal Data Protection Rules, 2025 (DPDP Rules) form the cornerstone of India's evolving data privacy framework. These regulations outline key obligations for Data Fiduciaries and rights for Data Principals, ensuring compliance with stringent data protection standards. With provisions such as legitimate data processing, verifiable consent mechanisms, and security safeguards, the DPDPA and DPDP Rules aim to foster accountability while empowering individuals with enhanced control over their personal data. This comprehensive mapping of DPDPA sections to DPDP Rules 2025 simplifies compliance strategies for organisations, offering clarity on key obligations, exemptions, and governance structures under India's data privacy regime. The DPDP Rules 2025, comprising 23 Rules and 7 Schedules, were notified on 13th November 2025.

The Digital Personal Data Protection Act, 2023 (DPDP Act) Sections	The Digital Personal Data Protection Rules, 2025 (DPDP Rules) – Corresponding Rules

Chapter I Preliminary Section 2: Definitions	Rule 2: Definitions
Chapter II Obligations of Data Fiduciary Section 5: Notice	Rule 3: Notice Given by Data Fiduciary to Data Principal
Section 6: Consent	Rule 4: Registration and Obligations of Consent Manager
Section 7: Certain Legitimate Uses.	Rule 5: Processing of Personal Data for Provision or Issue of Subsidy, Benefit, Service, Certificate, Licence or Permit by State and its Instrumentalities
Section 8: General Obligations of Data Fiduciary	Rule 6: Reasonable Security Safeguards
	Rule 7: Intimation of Personal Data Breach
	Rule 8: Time Period for Specified Purpose to be Deemed as No Longer Being Served
	Rule 9: Contact Information of Person to Answer Questions About Processing
Section 9: Processing of Personal Data of Children	Rule 10: Verifiable Consent for Processing of Personal Data of Child
	Rule 11: Verifiable Consent for Processing of Personal Data of Person with Disability who has Lawful Guardian
	Rule 12: Exemptions from Certain Obligations Applicable to Processing of Personal Data of Child
Section 10: Additional Obligations of Significant Data Fiduciary.	Rule 13: Additional Obligations of Significant Data Fiduciary
Chapter III Rights and Duties of Data Principal Section 11: Right to Access Information About Personal Data	Rule 14: Rights of Data Principals
Section 12: Right to Correction and Erasure of Personal Data
Section 13: Right of Grievance Redressal
Section 14: Right to Nominate
Section 15: Duties of Data Principal
Chapter IV Special Provisions Section 16: Processing of Personal Data Outside India	Rule 15: Transfer of Personal Data Outside the Territory of India
Section 17: Exemptions	Rule 16: Exemption from Act for Research, Archiving or Statistical Purposes
Chapter V Data Protection Board of India Section 18: Establishment of Board	Rule 17: Appointment of Chairperson and Other Members
Section 19: Composition and Qualifications for Appointment of Chairperson and Members.	Rule 17: Appointment of Chairperson and Other Members
Section 20: Salary, Allowances Payable to and Term of Office.	Rule 18: Salary, Allowances and Other Terms and Conditions of Service of Chairperson and Other Members
Section 23: Proceedings of Board.	Rule 19: Procedure for Meetings of Board and Authentication of Its Orders, Directions and Instruments
Section 24: Officers and Employees of Board	Rule 21: Terms and Conditions of Appointment and Service of Officers and Employees of Board
Chapter VI Powers, Functions and Procedure to be Followed by Board Section 27: Powers and Functions of Board	Rule 20: Functioning of Board as Digital Office
Section 28: Procedure to be Followed by Board.	Rule 20: Functioning of Board as Digital Office
Chapter VII Appeal and Alternate Dispute Resolution Section 29: Appeal to Appellate Tribunal	Rule 22: Appeal to Appellate Tribunal
Chapter IX Miscellaneous Section 36: Power to Call for Information.	Rule 23: Calling for Information from Data Fiduciary or Intermediary