Sign in Book a demo

The Act · Plain-English

The DPDP Act 2023,
section by section.

All 44 sections across 9 chapters — official text, plain-English commentary, and the platform modules that operationalise each one.

Chapter 1

Preliminary

Short title and commencement

Establishes the name and staged commencement. Companies should track government notifications because different sections can switch on at different times.

Definitions

Foundational vocabulary. Every role in the platform — tenants, principals, vendors, consent managers — maps directly to a definition here.

Application of the Act

Extra-territorial reach. Even India-targeting foreign businesses must comply. Onboarding wizard checks this for each tenant.

Chapter 2

Obligations of Data Fiduciary

Grounds for processing personal data

Two-track lawful basis: consent (§6) OR legitimate use (§7). Drives the lawful_basis dropdown on every consent purpose.

Notice

Drives the Notices module: each notice must satisfy a §5 checklist (purpose, data list, rights, grievance route, DPB complaint route, language coverage).

Consent

Core of the Consent Management module and SDK. §6(4) parity test ensures withdrawal UX matches the grant UX.

Certain legitimate uses

When a purpose uses §7, the consent widget is bypassed but the lawful_basis must be recorded and the Notice still applies. Reflected in lawful_basis dropdown.

General obligations of Data Fiduciary

Cross-cuts almost every module: Vendor contracts, Incident response (breach notification), Retention/erasure jobs, Grievance Officer in Settings.

Processing of personal data of children

Adds a "Children's Data" toggle per consent purpose, triggers parental-consent flow in the widget, and a hard-block on tracking purposes when enabled.

Additional obligations of Significant Data Fiduciary

Tenant flag is_sdf unlocks the SDF dashboard tab: DPO directory, annual DPIA cadence, audit export.

Chapter 3

Rights and Duties of Data Principal

Right to access information about personal data

DSAR type = ACCESS. SLA tracked under §13 grievance redressal.

Right to correction and erasure of personal data

DSAR types = CORRECTION, UPDATION, ERASURE.

Right of grievance redressal

DSAR module SLA timer (typically 30 days). Escalation path: Fiduciary → Board.

Right to nominate

Adds a nominee_contact field to consent records and to the DSAR submission form.

Duties of Data Principal

Surfaced as disclaimer on the public DSAR portal and on the consent widget.

Chapter 4

Special Provisions

Processing of personal data outside India

New data_transfers register + Vendor hosting_country field auto-flags transfers to restricted destinations.

Exemptions

DPIA includes an "Exemption claim" branch with required justification text.

Chapter 5

Data Protection Board of India

Establishment of Board

Reference. Drives the "Escalate to DPB" action in Incidents and DSARs.

Composition and qualifications

Reference content for Act Explorer.

Salary, allowances and conditions

Reference content for Act Explorer.

Disqualifications, resignation, removal

Reference content for Act Explorer.

Officers and employees of Board

Reference content for Act Explorer.

Meetings of Board

Reference content.

Authentication of orders

Reference content.

Members and officers to be public servants

Reference content.

Functions of Chairperson

Reference content.

Chapter 6

Powers, Functions, and Procedure of Board

Powers and functions of Board

Drives the "DPB complaint packet" export from Incident response.

Procedure to be followed by Board

Reference content; informs how complaint packets are structured.

Chapter 7

Appeal and Alternate Dispute Resolution

Appeal to Appellate Tribunal

Captured as escalation path in incident timeline.

Orders passed in appeal

Reference content.

Alternate Dispute Resolution

"Initiate mediation" action on DSAR and Incident records.

Voluntary undertaking

Reference content; informs Incident remediation flow.

Chapter 8

Penalties and Adjudication

Penalties

Powers the on-dashboard Penalty Calculator and AI Assistant exposure scores.

Crediting sums realised to Consolidated Fund

Reference content.

Chapter 9

Miscellaneous

Action by Central Government to be confidential

Drives the "Regulatory Notifications" feed surfacing on the dashboard.

Power to call for information

Reference; tenants should be ready with audit-grade records.

Power to block access to information

Reference.

Consistency with other laws

Reference; the AI Assistant cross-checks for IT Act, RBI, SEBI overlap.

Bar of jurisdiction of civil courts

Reference content.

Power of Central Government to make rules

The "Rules Tracker" — the DPDP Rules 2025 are the operational substance the platform monitors and applies.

Power of Board to make regulations

Reference content.

Laying of rules and regulations before Parliament

Reference content.

Power to amend the Schedule

Penalty Calculator must update when Schedule is amended.

Power to remove difficulties; consequential amendments

Important: RTI amendment narrows personal-information disclosure exemptions; AI Assistant flags any tenant flow that touches RTI requests.