ResourcesAct-to-Rules map

Which rules relate to which section

Many sections of the DPDP Act leave a matter to be “prescribed” by rules, and a few rules name or deal with a section without any such delegation. This page pairs sections of the Act with the rules and Schedules of the DPDP Rules, 2025 that relate to them, and says how each pair is connected.

What this map is

The Act’s own list of matters on which rules may be made is section 40(2). Agicentral matched three things: that list, the references in the rules’ own text, and rules that deal with the same subject as a section where neither the Act nor the rule says so. Each pair is labelled with which of the three it is, and a pair of the third kind has no express delegation or reference. It is a finding aid made by us. It is not part of the law, and it may miss a rule that touches a section indirectly. Read the linked provisions for the authoritative wording.

By section of the Act

20 provisions of the Act, in the order they appear. Titles are as printed in the Gazette.

Section 5 · Notice

Rule 3 · Notice given by Data Fiduciary to Data Principal

Prescribed under the ActSection 40(2)(a) and (b): the manner in which the notice informs the Data Principal, under section 5(1) and (2).

Section 6 · Consent

Rule 4 · Registration and obligations of Consent Manager
First Schedule · Consent Managers — conditions of registration and obligations

Prescribed under the ActSection 40(2)(c) and (d): the Consent Manager’s accountability and obligations (section 6(8)) and registration conditions (section 6(9)). The First Schedule is headed “See rule 4”.

Section 7 · Certain legitimate uses

Rule 5 · Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities
Second Schedule · Standards for processing by the State and for research, archiving or statistical purposes

Prescribed under the ActSection 7(b) and section 40(2)(e): the benefits for which data may be processed are those “as may be prescribed”. Rule 5(1) requires processing to follow the Second Schedule standards.

Section 8 · General obligations of Data Fiduciary

Rule 6 · Reasonable security safeguards

Same subjectNo express delegation: rule 6(1) opens with the words of section 8(5) (“reasonable security safeguards to prevent personal data breach”) and adds minimum safeguards.

Section 8 · General obligations of Data Fiduciary

Rule 7 · Intimation of personal data breach
Rule 8 · Time period for specified purpose to be deemed as no longer being served
Rule 9 · Contact information of person to answer questions about processing
Third Schedule · Time periods after which personal data must be erased

Prescribed under the ActSection 40(2)(f), (g) and (h): form and manner of breach intimation (section 8(6)), the period after which the purpose is deemed no longer served (section 8(8); Third Schedule) and publication of contact information (section 8(9)).

Section 9 · Processing of personal data of children

Rule 10 · Verifiable consent for processing of personal data of child
Rule 11 · Verifiable consent for processing of personal data of person with disability who has lawful guardian
Rule 12 · Exemptions from certain obligations applicable to processing of personal data of child
Fourth Schedule · Exemptions from certain obligations on children's data

Prescribed under the ActSection 40(2)(i) and (j): the manner of obtaining verifiable consent (section 9(1)) and the classes, purposes and conditions for exemption (section 9(4)). The Fourth Schedule is headed “See rule 12”.

Section 10 · Additional obligations of Significant Data Fiduciary

Rule 13 · Additional obligations of Significant Data Fiduciary

Prescribed under the ActSection 40(2)(k) and (l): other matters of the impact-assessment process and other measures for a Significant Data Fiduciary (section 10(2)(c)). Rule 13 cites neither item; it sets a twelve-month assessment and audit cycle and further measures.

Section 11 · Right to access information about personal data

Rule 14 · Rights of Data Principals

Prescribed under the ActSection 40(2)(m): the manner of making a request for information under section 11(1).

Section 12 · Right to correction and erasure of personal data

Rule 14 · Rights of Data Principals

Prescribed under the ActSection 40(2)(n): the manner of requesting erasure under section 12(3).

Section 13 · Right of grievance redressal

Rule 14 · Rights of Data Principals

Prescribed under the ActSection 40(2)(o): the period for responding to grievances under section 13(2). Rule 14(3) sets “a reasonable period not exceeding ninety days”.

Section 14 · Right to nominate

Rule 14 · Rights of Data Principals

Prescribed under the ActSection 40(2)(p): the manner of nomination under section 14(1); see rule 14(4).

Section 16 · Processing of personal data outside India

Rule 13 · Additional obligations of Significant Data Fiduciary
Rule 15 · Transfer of personal data outside the territory of India

Same subjectNo express delegation, and neither text cites the other. Rule 15 deals with transfers of personal data outside India; rule 13(4) restricts transfers of specified data by a Significant Data Fiduciary.

Section 17 · Exemptions

Rule 16 · Exemption from Act for research, archiving or statistical purposes
Second Schedule · Standards for processing by the State and for research, archiving or statistical purposes

Prescribed under the ActSection 17(2)(b) and section 40(2)(q): research, archiving and statistical processing must follow standards “as may be prescribed”. Rule 16 applies the Second Schedule standards.

Section 19 · Composition and qualifications for appointment of Chairperson and Members

Rule 17 · Appointment of Chairperson and other Members

Prescribed under the ActSection 40(2)(r): the manner of appointing the Chairperson and other Members.

Section 20 · Salary, allowances payable to and term of office

Rule 18 · Salary, allowances and other terms and conditions of service of Chairperson and other Members
Fifth Schedule · Terms of service of the Board's Chairperson and Members

Prescribed under the ActSection 40(2)(s): salary, allowances and terms of service of the Chairperson and Members. The Fifth Schedule is headed “See rule 18”.

Section 23 · Proceedings of Board

Rule 19 · Procedure for meetings of Board and authentication of its orders, directions and instruments

Prescribed under the ActSection 40(2)(t): the manner of authenticating the Board’s orders, directions and instruments (rule 19(8)); rule 19 also sets meeting procedure.

Section 24 · Officers and employees of Board

Rule 21 · Terms and conditions of appointment and service of officers and employees of Board
Sixth Schedule · Terms of service of the Board's officers and employees

Prescribed under the ActSection 40(2)(u): terms of appointment and service of the Board’s officers and employees. The Sixth Schedule is headed “See rule 21(2)”.

Section 27 · Powers and functions of Board

Rule 19 · Procedure for meetings of Board and authentication of its orders, directions and instruments

Named in the rule’s textRule 19(9) names section 27: the Board’s inquiry is to be completed within six months, extendable for recorded reasons. No express delegation.

Section 28 · Procedure to be followed by Board

Rule 20 · Functioning of Board as digital office

Prescribed under the ActSection 40(2)(v): the techno-legal measures the Board adopts under section 28(1). Rule 20 has the Board function as a digital office and adopt them.

Section 29 · Appeal to Appellate Tribunal

Rule 22 · Appeal to Appellate Tribunal

Prescribed under the ActSection 40(2)(x) and (y): the form, manner and fee for an appeal (section 29(2)) and the procedure for dealing with it (section 29(8)).

Section 36 · Power to call for information

Rule 23 · Calling for information from Data Fiduciary or intermediary
Seventh Schedule · Purposes and authorised persons for calling for information

Same subjectNo express delegation: rule 23(1) follows the power in section 36 to call for information in similar words, limited to the purposes listed in the Seventh Schedule.

By rule

The same pairings read the other way round: each rule or Schedule, and the provisions of the Act it relates to.

Rule 3 · Notice given by Data Fiduciary to Data Principal
Related to Section 5 · Notice (Prescribed under the Act)
Rule 4 · Registration and obligations of Consent Manager
Related to Section 6 · Consent (Prescribed under the Act)
Rule 5 · Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities
Related to Section 7 · Certain legitimate uses (Prescribed under the Act)
Rule 6 · Reasonable security safeguards
Related to Section 8 · General obligations of Data Fiduciary (Same subject)
Rule 7 · Intimation of personal data breach
Related to Section 8 · General obligations of Data Fiduciary (Prescribed under the Act)
Rule 8 · Time period for specified purpose to be deemed as no longer being served
Related to Section 8 · General obligations of Data Fiduciary (Prescribed under the Act)
Rule 9 · Contact information of person to answer questions about processing
Related to Section 8 · General obligations of Data Fiduciary (Prescribed under the Act)
Rule 10 · Verifiable consent for processing of personal data of child
Related to Section 9 · Processing of personal data of children (Prescribed under the Act)
Rule 11 · Verifiable consent for processing of personal data of person with disability who has lawful guardian
Related to Section 9 · Processing of personal data of children (Prescribed under the Act)
Rule 12 · Exemptions from certain obligations applicable to processing of personal data of child
Related to Section 9 · Processing of personal data of children (Prescribed under the Act)
Rule 13 · Additional obligations of Significant Data Fiduciary
Related to Section 10 · Additional obligations of Significant Data Fiduciary (Prescribed under the Act); Section 16 · Processing of personal data outside India (Same subject)
Rule 14 · Rights of Data Principals
Related to Section 11 · Right to access information about personal data (Prescribed under the Act); Section 12 · Right to correction and erasure of personal data (Prescribed under the Act); Section 13 · Right of grievance redressal (Prescribed under the Act); Section 14 · Right to nominate (Prescribed under the Act)
Rule 15 · Transfer of personal data outside the territory of India
Related to Section 16 · Processing of personal data outside India (Same subject)
Rule 16 · Exemption from Act for research, archiving or statistical purposes
Related to Section 17 · Exemptions (Prescribed under the Act)
Rule 17 · Appointment of Chairperson and other Members
Related to Section 19 · Composition and qualifications for appointment of Chairperson and Members (Prescribed under the Act)
Rule 18 · Salary, allowances and other terms and conditions of service of Chairperson and other Members
Related to Section 20 · Salary, allowances payable to and term of office (Prescribed under the Act)
Rule 19 · Procedure for meetings of Board and authentication of its orders, directions and instruments
Related to Section 23 · Proceedings of Board (Prescribed under the Act); Section 27 · Powers and functions of Board (Named in the rule’s text)
Rule 20 · Functioning of Board as digital office
Related to Section 28 · Procedure to be followed by Board (Prescribed under the Act)
Rule 21 · Terms and conditions of appointment and service of officers and employees of Board
Related to Section 24 · Officers and employees of Board (Prescribed under the Act)
Rule 22 · Appeal to Appellate Tribunal
Related to Section 29 · Appeal to Appellate Tribunal (Prescribed under the Act)
Rule 23 · Calling for information from Data Fiduciary or intermediary
Related to Section 36 · Power to call for information (Same subject)
First Schedule · Consent Managers — conditions of registration and obligations
Related to Section 6 · Consent (Prescribed under the Act)
Second Schedule · Standards for processing by the State and for research, archiving or statistical purposes
Related to Section 7 · Certain legitimate uses (Prescribed under the Act); Section 17 · Exemptions (Prescribed under the Act)
Third Schedule · Time periods after which personal data must be erased
Related to Section 8 · General obligations of Data Fiduciary (Prescribed under the Act)
Fourth Schedule · Exemptions from certain obligations on children's data
Related to Section 9 · Processing of personal data of children (Prescribed under the Act)
Fifth Schedule · Terms of service of the Board's Chairperson and Members
Related to Section 20 · Salary, allowances payable to and term of office (Prescribed under the Act)
Sixth Schedule · Terms of service of the Board's officers and employees
Related to Section 24 · Officers and employees of Board (Prescribed under the Act)
Seventh Schedule · Purposes and authorised persons for calling for information
Related to Section 36 · Power to call for information (Same subject)

About the Act text

Reproduced verbatim from the official Gazette PDF. Text last verified against the official PDF on 1 October 2026.

Instrument: The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
Published: 11 August 2023 · The Gazette of India, Extraordinary, Part II — Section 1, No. 25, New Delhi, Friday, 11 August 2023 (CG-DL-E-12082023-248045)
Issued by: Ministry of Law and Justice (Legislative Department)

Official sources

The DPDP Act, 2023 — official Gazette PDF (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
G.S.R. 843(E) — dates on which the Act's provisions come into force (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)

Download PDFEnglish · 21 pages · 178 KB Spotted a discrepancy? Tell us

General information, not legal advice. The Gazette notification is the authoritative text. The summaries, links and labels around the text are Agicentral’s own and are not part of the law.

About the Rules text

Reproduced verbatim from the official Gazette PDF. Text last verified against the official PDF on 1 October 2026.

Instrument: The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))
Published: 13 November 2025 · The Gazette of India, Extraordinary, Part II — Section 3(i), New Delhi, 13 November 2025 (F. No. AA-11038/1/2025-CLandES)
Issued by: Ministry of Electronics and Information Technology

Official sources

The DPDP Rules, 2025 — official Gazette PDF (Hindi pp. 1–23, English pp. 24–41) (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
G.S.R. 892(E) — corrigendum to the DPDP Rules, 2025 (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)

Download PDFEnglish · 18 pages · 366 KB Spotted a discrepancy? Tell us

General information, not legal advice. The Gazette notification is the authoritative text. The summaries, links and labels around the text are Agicentral’s own and are not part of the law.