Read the official text of the DPDP Act and the DPDP Rules section by section, search every provision, and download the Gazette PDFs. Plain-language summaries sit beside the law — never inside it.
Look up a word, a figure such as “72 hours”, or go straight to a provision with “section 8” or “rule 7”. Every result opens the official text.
Both instruments are reproduced exactly as published in the Gazette of India, with the printed headings and numbering.
Published 11 August 2023 · Ministry of Law and Justice (Legislative Department)
The law itself: who it covers, what organisations owe individuals, the Data Protection Board and the penalties.
44 sections · 9 chapters · 1 Schedule
Notified 13 November 2025 · Ministry of Electronics and Information Technology
The detail the Act leaves to be prescribed: notices, consent managers, breach reports, children’s data, timelines and procedure.
23 rules · 7 schedules
Figures taken from the text. Each one links to the provision it comes from.
Up to ₹250 crore
Highest penalty ceiling in the Schedule
The penalty for failing to take reasonable security safeguards (section 8(5)) “may extend to” two hundred and fifty crore rupees.
Source: The Schedule, item 1
Under 18
Age of a child
A “child” is an individual who has not completed the age of eighteen years.
Source: Section 2(f)
Any time
Withdrawing consent
Where consent is the basis of processing, the Data Principal may withdraw it at any time, with comparable ease to giving it.
Source: Section 6(4)
72 hours
Deadline for updated and detailed breach information to the Board
Within seventy-two hours of becoming aware, the Data Fiduciary gives the Board updated, detailed information, unless the Board allows longer.
Source: Rule 7(2)(b)
1 year
Minimum retention of data and logs for Seventh Schedule purposes
A Data Fiduciary retains personal data, traffic data and logs of processing for at least one year, for Seventh Schedule purposes.
Source: Rule 8(3)
90 days
Ceiling on grievance response time
Data Fiduciaries and Consent Managers must publish a grievance redressal system that responds within a reasonable period not exceeding ninety days.
The Act and the Rules do not start all at once. Three dates matter, and which one applies depends on the provision.
Stage 1
13 November 2025
Date of publication of the notification
Stage 2
13 November 2026
One year from publication
Stage 3
13 May 2027
Eighteen months from publication
Dates computed from the 13 November 2025 publication. The Act’s come from G.S.R. 843(E) and the Rules’ from G.S.R. 846(E), rule 1. The first date is stated in them; the later ones are counted from the periods they give (one year from publication and eighteen months from publication).
See the full timelineShort answers with links to the provisions they come from.
The Act governs digital personal data processing, in India (collected digitally, or non-digitally and later digitised) and outside India where it relates to offering goods or services to Data Principals in India. It excludes personal or domestic use and some publicly available data (section 3). Section 17 and the Rules add further exemptions.
Read the text: Section 3, Section 17
A Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. A Data Principal is the individual the data relates to, including a child's parents or lawful guardian. A Data Processor is any person who processes personal data on a Data Fiduciary's behalf.
Read the text: Section 2(i), Section 2(j), Section 2(k)
The highest stated figure is ₹250 crore, for failing to take reasonable security safeguards; Schedule penalties “may extend to” the amount stated. Other items run from ₹200 crore down to ₹10,000, and item 6 has no fixed figure. The Board may impose them if an inquiry finds a breach significant.
Read the text: The Schedule, items 1 to 7, Section 33(1)
Without delay, with fuller detail within seventy-two hours. On becoming aware of a breach, a Data Fiduciary must inform each affected Data Principal and give the Board a description, both without delay. Within seventy-two hours, or a longer period the Board allows on written request, it must give the Board updated, detailed information.
Read the text: Section 8(6), Rule 7(1), Rule 7(2)
A child is an individual under eighteen, and yes: a Data Fiduciary must obtain verifiable parental consent before processing a child's data, after checking that the self-identified parent is an adult. It must not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule list exemptions.
Read the text: Section 2(f), Section 9(1) to (4), Rule 10(1), Rule 12, Fourth Schedule, Parts A and B
Yes. Where consent is the basis of processing, the Data Principal may withdraw it at any time, with comparable ease to giving it. Earlier processing stays lawful. The Data Fiduciary must then, within a reasonable time, stop processing and cause its Data Processors to stop, unless law requires or authorises it.
Read the text: Section 6(4), Section 6(5), Section 6(6)
Rights to information about her personal data (section 11) and to correction, completion, updating and erasure (section 12), where she previously gave consent; erasure yields to retention the purpose or law requires. Also grievance redress (section 13) and nominating another individual to act on her death or incapacity (section 14), subject to section 17.
Read the text: Section 11(1), Section 12(1) and (3), Section 13(1) and (3), Section 14(1), Section 17
A Data Fiduciary or class of Data Fiduciaries that the Central Government notifies after assessing factors including data volume and sensitivity and risk to Data Principals' rights. It must appoint an India-based Data Protection Officer and an independent data auditor, and undertake periodic impact assessments and audits (rule 13: every twelve months).
Read the text: Section 10(1) and (2), Rule 13(1)
Once consent is withdrawn or the purpose is reasonably assumed no longer served, whichever is earlier, unless law requires retention (section 8(7)). For Third Schedule classes with registered-user minimums (e-commerce, online gaming, social media), rule 8 sets three years from the Data Principal's last approach or the Rules' commencement, whichever is latest, for most purposes.
Read the text: Section 8(7) and (8), Rule 8(1), Third Schedule, items 1 to 3
Yes, subject to restrictions. The Central Government may restrict transfers to countries or territories it notifies, and Indian laws giving higher protection still apply (section 16). Rule 15 subjects transfers to Government-specified requirements for making data available to a foreign State, its agencies, or entities it controls.
Read the text: Section 16(1) and (2), Rule 15
A person registered with the Board who acts as a Data Principal's single point of contact to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Registration requires the First Schedule, Part A conditions, including being a company incorporated in India with net worth of at least ₹2 crore.
Read the text: Section 2(g), Rule 4(1) and (2), First Schedule, Part A, items 1 and 4
Established under section 18 by notification G.S.R. 844(E), with effect from publication on 13 November 2025. The Act makes it a body corporate with perpetual succession, with a Chairperson and other Members. Section 27's inquiry and penalty powers start in stages: clause (1)(d) on 13 November 2026, the rest on 13 May 2027 (both computed).
Read the text: Section 18(1) and (2), Section 19(1), Section 27(1)
Also from: G.S.R. 844(E) — establishment of the Data Protection Board of India (opens in a new tab), G.S.R. 843(E) — dates on which the Act's provisions come into force (opens in a new tab)
Yes. A person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal (the Telecom Disputes Settlement and Appellate Tribunal) within sixty days of receipt. The Tribunal may entertain a later appeal for sufficient cause. Rule 22 provides for digital filing and a fee, which the Tribunal’s Chairperson may reduce or waive.
Read the text: Section 2(a), Section 29(1) to (3), Rule 22(1) and (2)
In three stages counted from the 13 November 2025 Gazette; the 2026 and 2027 dates are computed from the stated periods. On publication: sections 1(2), 2, 18–26, 35, 38–43, 44(1), (3); rules 1, 2, 17–21. After one year (13 November 2026): section 6(9), 27(1)(d); rule 4. After eighteen months (13 May 2027): most other provisions.
Read the text: Section 1(2), Rule 1(2) to (4)
Also from: G.S.R. 843(E) — dates on which the Act's provisions come into force (opens in a new tab)
Reference pages that sit beside the Act and the Rules.
The Government of India notifications and announcements this library is built from. Every link was checked on 1 October 2026.
Ministry of Electronics and Information Technology (MeitY)
MeitY's copy of the Act as published in the Gazette of India, Extraordinary (CG-DL-E-12082023-248045).
Ministry of Electronics and Information Technology (MeitY)
G.S.R. 846(E), 13 November 2025, as first published (before the corrigendum). Bilingual file.
Ministry of Electronics and Information Technology (MeitY)
The notification appointing the commencement dates under section 1(2) of the Act.
Ministry of Electronics and Information Technology (MeitY)
Corrigenda dated 10 December 2025 to G.S.R. 846(E).
Ministry of Electronics and Information Technology (MeitY)
Notification under section 18 of the Act establishing the Board.
Ministry of Electronics and Information Technology (MeitY)
Notification under section 19(1) of the Act.
Press Information Bureau, Government of India
Official announcement of the Rules and their phased timeline.
Press Information Bureau, Government of India
Official explainer on the Rules.
The statutory text is reproduced exactly as published, and every page names its Gazette reference and PDF pages. We last checked the text against the official PDFs on 1 October 2026.
Summaries, key facts, dates and notes are Agicentral’s own aids. They sit beside the text, labelled, and are never mixed into it. This is general information, not legal advice; the Gazette is authoritative.
If something here differs from the Gazette, tell us and we will check it.
Email us at hello@agicentral.com
Start with a quick readiness assessment, or book a walkthrough to see how the platform can support your team.