Digital Personal Data Protection Act,2023

Mapping of Sections of DPDPA to DPDP Rules

The Digital Personal Data Protection Act, 2023 (DPDPA) and its corresponding Digital Personal Data Protection Rules, 2025 (DPDP Rules) form the cornerstone of India's evolving data privacy framework. These regulations outline key obligations for Data Fiduciaries and rights for Data Principals, ensuring compliance with stringent data protection standards. With provisions such as legitimate data processing, verifiable consent mechanisms, and security safeguards, the DPDPA and DPDP Rules aim to foster accountability while empowering individuals with enhanced control over their personal data. This comprehensive mapping of DPDPA sections to DPDP rules simplifies compliance strategies for organizations, offering clarity on key obligations, exemptions, and governance structures under India's new data privacy regime.

The Digital Personal Data Protection Act, 2023 (DPDP Act) Sections	The Digital Personal Data Protection Rules, 2025 (DPDP Rules) - Corresponding Rules

Chapter I Preliminary Section 2: Definitions	Rule 2: Definitions
Chapter II Obligations of Data Fiduciary Section 5: Notice	Rule 3: Notice given by Data Fiduciary to Data Principal
Section 6: Consent	Rule 4: Registration and Obligations of Consent Manager
Section 7: Certain legitimate uses.	Rule 5: Processing for Provision or Issue of Subsidy, Benefit, Service, Certificate, License or Permit by State and its Instrumentalities
Section 8: General Obligations of Data Fiduciary	Rule 6: Reasonable Security Safeguards
	Rule 7: Intimation of Personal Data Breach
	Rule 8: Time Period for Specified Purpose to be Deemed as No Longer Being Served
	Rule 9: Contact Information of Person to Answer Questions About Processing
Section 9: Processing of personal data of children	Rule 10: Verifiable Consent for Processing of Personal Data of Child or of Person with Disability Who has Lawful Guardian
Section 9: Processing of personal data of children	Rule 11: Exemptions from certain obligations applicable to processing of personal data of child
Section 10: Additional obligations of Significant Data Fiduciary.	Rule 12: Additional obligations of Significant Data Fiduciary
Chapter III Rights and Duties of Data Principal Section 11: Right to access information about personal data	Rule 13: Rights of Data Principals
Section 12: Right to Correction and erasure of Personal Data
Section 13: Right of Grievance Redressal
Section 14: Right to nominee
Section 15: Duties of Data Principal
Chapter IV Special Provisions Section 16: Processing of personal data outside India	Rule 14: Processing of Personal Data Outside India
Section 17: Exemptions	Rule 15: Exemption from Act for Research, Archiving or Statistical Purpose
Chapter V Data Protection Board of India Section 18: Establishment of Board	Rule 16: Appointment of Chairperson and Other Members
Section 19: Composition and qualifications for appointment of Chairperson and Members.	Rule 16: Appointment of Chairperson and Other Members
Section 20: Salary, allowances payable to and term of office.	Rule 17: Salary, Allowances and Other Terms and Conditions of Service of Chairperson and Other Members
Section 23: Proceedings of Board.	Rule 18: Procedure for Meetings of Board and Authentication of Its Orders, Directions and Instruments
Section 24: Officers and Employees of Boards	Rule 20: Terms and Conditions of Appointment and Service of Officers and Employees of Board
Chapter VI Powers, Functions and Procedure to be Followed by Board Section 27: Powers and Functions of Board	Rule 19: Functioning of Board as Digital Office
Section 28: Procedure to be followed by Board.	Rule 19: Functioning of Board as Digital Office
Chapter VII Appeal and Alternate Dispute Resolution Section 29: Appeal to Appellate Tribunal	Rule 21: Appeal to Appellate Tribunal
Chapter IX Miscellaneous Section 36: Power to call for information.	Rule 22: Calling for Information from Data Fiduciary or Intermediary