Reference

DPDP Act to Rules map: which rule implements which section

All 23 rules of the DPDP Rules 2025, mapped to the provisions of the DPDP Act 2023 they operationalise. The map runs through section 40, the rule making power, because 25 of its clauses name the exact Act provision they authorise rules for.

Plain English

How to read this map. The Rules were made in exercise of the powers in section 40(1) and 40(2) of the Act, and section 40(2) lists its matters clause by clause, each naming an Act provision by number. Those clause texts are official and quoted below. Pairing a numbered rule to a clause is a different kind of statement: neither instrument publishes a concordance, so the pairing is this site's reading of subject matter and is marked as interpretation. 18 of the 23 rules take up a named clause. 3 work on provisions that no clause names, so they rest on the general power with the residual clause 40(2)(z). 2 are the instrument's own machinery.

Rule by rule

Rule	What it governs	Act provision	Rule making power	Basis
Rule 1	Short title and commencement	Not an operative duty	40(1)	Instrument machinery
Rule 2	Definitions	Not an operative duty	40(1)	Instrument machinery
Rule 3	Notice given by Data Fiduciary to Data Principal	s. 5(1), s. 5(2)	40(2)(a), 40(2)(b)	Named clause
Rule 4	Registration and obligations of Consent Manager	s. 6(8), s. 6(9)	40(2)(c), 40(2)(d)	Named clause
Rule 5	Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities	s. 7(b)	40(2)(e)	Named clause
Rule 6	Reasonable security safeguards	s. 8(5)	40(1) with 40(2)(z)	General power
Rule 7	Intimation of personal data breach	s. 8(6)	40(2)(f)	Named clause
Rule 8	Time period for specified purpose to be deemed as no longer being served	s. 8(8)	40(2)(g)	Named clause
Rule 9	Contact information of person to answer questions about processing	s. 8(9)	40(2)(h)	Named clause
Rule 10	Verifiable consent for processing of personal data of child	s. 9(1)	40(2)(i)	Named clause
Rule 11	Verifiable consent for processing of personal data of person with disability who has lawful guardian	s. 9(1)	40(2)(i)	Named clause
Rule 12	Exemptions from certain obligations applicable to processing of personal data of child	s. 9(4)	40(2)(j)	Named clausesection 9 named in the rule text
Rule 13	Additional obligations of Significant Data Fiduciary	s. 10(2)(c)(i), s. 10(2)(c)(iii)	40(2)(k), 40(2)(l)	Named clause
Rule 14	Rights of Data Principals	s. 11(1), s. 12(3), s. 13(2), s. 14(1)	40(2)(m), 40(2)(n), 40(2)(o), 40(2)(p)	Named clause
Rule 15	Transfer of personal data outside the territory of India	s. 16	40(1) with 40(2)(z)	General power
Rule 16	Exemption from Act for research, archiving or statistical purposes	s. 17(2)(b)	40(2)(q)	Named clause
Rule 17	Appointment of Chairperson and other Members	s. 19(2)	40(2)(r)	Named clause
Rule 18	Salary, allowances and other terms and conditions of service of Chairperson and other Members	s. 20(1)	40(2)(s)	Named clause
Rule 19	Procedure for meetings of Board and authentication of its orders, directions and instruments	s. 23(1)	40(2)(t)	Named clause
Rule 20	Functioning of Board as digital office	s. 28(1)	40(2)(v)	Named clause
Rule 21	Terms and conditions of appointment and service of officers and employees of Board	s. 24	40(2)(u)	Named clause
Rule 22	Appeal to Appellate Tribunal	s. 29(2), s. 29(8)	40(2)(x), 40(2)(y)	Named clause
Rule 23	Calling for information from Data Fiduciary or intermediary	s. 36	40(1) with 40(2)(z)	General power

Rule 1 · Short title and commencement

Act provision: Not an operative duty
Power: 40(1)
Basis: Instrument machinery

Rule 2 · Definitions

Act provision: Not an operative duty
Power: 40(1)
Basis: Instrument machinery

Rule 3 · Notice given by Data Fiduciary to Data Principal

Act provision: s. 5(1), s. 5(2)
Power: 40(2)(a), 40(2)(b)
Basis: Named clause

Rule 4 · Registration and obligations of Consent Manager

Act provision: s. 6(8), s. 6(9)
Power: 40(2)(c), 40(2)(d)
Basis: Named clause

Rule 5 · Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities

Act provision: s. 7(b)
Power: 40(2)(e)
Basis: Named clause

Rule 6 · Reasonable security safeguards

Act provision: s. 8(5)
Power: 40(1) with 40(2)(z)
Basis: General power

Rule 7 · Intimation of personal data breach

Act provision: s. 8(6)
Power: 40(2)(f)
Basis: Named clause

Rule 8 · Time period for specified purpose to be deemed as no longer being served

Act provision: s. 8(8)
Power: 40(2)(g)
Basis: Named clause

Rule 9 · Contact information of person to answer questions about processing

Act provision: s. 8(9)
Power: 40(2)(h)
Basis: Named clause

Rule 10 · Verifiable consent for processing of personal data of child

Act provision: s. 9(1)
Power: 40(2)(i)
Basis: Named clause

Rule 11 · Verifiable consent for processing of personal data of person with disability who has lawful guardian

Act provision: s. 9(1)
Power: 40(2)(i)
Basis: Named clause

Rule 12 · Exemptions from certain obligations applicable to processing of personal data of child

Act provision: s. 9(4)
Power: 40(2)(j)
Basis: Named clause

Rule 13 · Additional obligations of Significant Data Fiduciary

Act provision: s. 10(2)(c)(i), s. 10(2)(c)(iii)
Power: 40(2)(k), 40(2)(l)
Basis: Named clause

Rule 14 · Rights of Data Principals

Act provision: s. 11(1), s. 12(3), s. 13(2), s. 14(1)
Power: 40(2)(m), 40(2)(n), 40(2)(o), 40(2)(p)
Basis: Named clause

Rule 15 · Transfer of personal data outside the territory of India

Act provision: s. 16
Power: 40(1) with 40(2)(z)
Basis: General power

Rule 16 · Exemption from Act for research, archiving or statistical purposes

Act provision: s. 17(2)(b)
Power: 40(2)(q)
Basis: Named clause

Rule 17 · Appointment of Chairperson and other Members

Act provision: s. 19(2)
Power: 40(2)(r)
Basis: Named clause

Rule 18 · Salary, allowances and other terms and conditions of service of Chairperson and other Members

Act provision: s. 20(1)
Power: 40(2)(s)
Basis: Named clause

Rule 19 · Procedure for meetings of Board and authentication of its orders, directions and instruments

Act provision: s. 23(1)
Power: 40(2)(t)
Basis: Named clause

Rule 20 · Functioning of Board as digital office

Act provision: s. 28(1)
Power: 40(2)(v)
Basis: Named clause

Rule 21 · Terms and conditions of appointment and service of officers and employees of Board

Act provision: s. 24
Power: 40(2)(u)
Basis: Named clause

Rule 22 · Appeal to Appellate Tribunal

Act provision: s. 29(2), s. 29(8)
Power: 40(2)(x), 40(2)(y)
Basis: Named clause

Rule 23 · Calling for information from Data Fiduciary or intermediary

Act provision: s. 36
Power: 40(1) with 40(2)(z)
Basis: General power

The rule making power column above is a subject matter reading, not a statement either instrument makes, and a rule can reach further than the clause it answers. Rule 8(3) sets a 1 year retention floor for personal data, traffic data and logs, and Rule 19(9) sets a 6 month limit on Board inquiries: no clause of section 40(2) names either matter.

The 3 rules that no clause names

Most rules answer a clause of section 40(2) that names their Act provision outright. 3 do not, and the reason is worth knowing: the provisions they work on do not use the words as may be prescribed, so the Act never expressly invited a rule on them.

Rule 6 · Reasonable security safeguards
Section 8(5) requires reasonable security safeguards but does not say as may be prescribed, and no clause of section 40(2) names it. Rule 6 therefore rests on the general power in section 40(1), read with the residual clause 40(2)(z).
Rule 15 · Transfer of personal data outside the territory of India
Section 16(1) works by notification rather than by rules, and no clause of section 40(2) names it, so Rule 15 rests on the general power in section 40(1) with the residual clause 40(2)(z).
Rule 23 · Calling for information from Data Fiduciary or intermediary
Section 36 lets the Central Government require information without saying as may be prescribed, and no clause of section 40(2) names it, so Rule 23 rests on the general power in section 40(1) with the residual clause 40(2)(z).

Section by section, the other direction

Reading from the Act instead: which rules carry each section into practice. On the same reading, a section with no row here has no rule of its own in the 2025 set.

Section 5 · Notice
Rule 3
Section 6 · Consent
Rule 4
Section 7 · Certain legitimate uses
Rule 5
Section 8 · General obligations of Data Fiduciary
Rule 6 · Rule 7 · Rule 8 · Rule 9
Section 9 · Processing of personal data of children
Rule 10 · Rule 11 · Rule 12
Section 10 · Additional obligations of Significant Data Fiduciary
Rule 13
Section 11 · Right to access information about personal data
Rule 14
Section 12 · Right to correction and erasure of personal data
Rule 14
Section 13 · Right of grievance redressal
Rule 14
Section 14 · Right to nominate
Rule 14
Section 16 · Processing of personal data outside India
Rule 15
Section 17 · Exemptions
Rule 16
Section 19 · Composition and qualifications for appointment of Chairperson and Members
Rule 17
Section 20 · Salary, allowances payable to and term of office
Rule 18
Section 23 · Proceedings of Board
Rule 19
Section 24 · Officers and employees of Board
Rule 21
Section 28 · Procedure to be followed by Board
Rule 20
Section 29 · Appeal to Appellate Tribunal
Rule 22
Section 36 · Power to call for information
Rule 23

Clauses the 2025 Rules do not take up

Section 40(2) authorises more than the 2025 set uses. No rule in this set obviously exercises the clause below, which leaves room for a later set of rules to do so. Reading a clause as unused is interpretation: it rests on comparing subject matter, not on any statement in either instrument.

40(2)(w), on section 28(7)(d): “the other matters under clause (d) of sub-section (7) of section 28”

Section 40(2) in full

The official list, verbatim. Every entry names the Act provision it authorises rules for, which is what makes this map checkable rather than editorial.

Clause	Provision	Matter, as printed	Taken up by
40(2)(a)	s. 5(1)	the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5	Rule 3
40(2)(b)	s. 5(2)	the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5	Rule 3
40(2)(c)	s. 6(8)	the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6	Rule 4
40(2)(d)	s. 6(9)	the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6	Rule 4
40(2)(e)	s. 7(b)	the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7	Rule 5
40(2)(f)	s. 8(6)	the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8	Rule 7
40(2)(g)	s. 8(8)	the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8	Rule 8
40(2)(h)	s. 8(9)	the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8	Rule 9
40(2)(i)	s. 9(1)	the manner of obtaining verifiable consent under sub-section (1) of section 9	Rule 10, Rule 11
40(2)(j)	s. 9(4)	the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9	Rule 12
40(2)(k)	s. 10(2)(c)(i)	the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10	Rule 13
40(2)(l)	s. 10(2)(c)(iii)	the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10	Rule 13
40(2)(m)	s. 11(1)	the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11	Rule 14
40(2)(n)	s. 12(3)	the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12	Rule 14
40(2)(o)	s. 13(2)	the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13	Rule 14
40(2)(p)	s. 14(1)	the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14	Rule 14
40(2)(q)	s. 17(2)(b)	the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17	Rule 16
40(2)(r)	s. 19(2)	the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19	Rule 17
40(2)(s)	s. 20(1)	the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20	Rule 18
40(2)(t)	s. 23(1)	the manner of authentication of orders, directions and instruments under sub-section (1) of section 23	Rule 19
40(2)(u)	s. 24	the terms and conditions of appointment and service of officers and employees of the Board under section 24	Rule 21
40(2)(v)	s. 28(1)	the techno-legal measures to be adopted by the Board under sub-section (1) of section 28	Rule 20
40(2)(w)	s. 28(7)(d)	the other matters under clause (d) of sub-section (7) of section 28	Not taken up
40(2)(x)	s. 29(2)	the form, manner and fee for filing an appeal under sub-section (2) of section 29	Rule 22
40(2)(y)	s. 29(8)	the procedure for dealing an appeal under sub-section (8) of section 29	Rule 22

40(2)(a) · s. 5(1)the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5
40(2)(b) · s. 5(2)the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5
40(2)(c) · s. 6(8)the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6
40(2)(d) · s. 6(9)the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6
40(2)(e) · s. 7(b)the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7
40(2)(f) · s. 8(6)the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8
40(2)(g) · s. 8(8)the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8
40(2)(h) · s. 8(9)the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8
40(2)(i) · s. 9(1)the manner of obtaining verifiable consent under sub-section (1) of section 9
40(2)(j) · s. 9(4)the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9
40(2)(k) · s. 10(2)(c)(i)the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10
40(2)(l) · s. 10(2)(c)(iii)the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10
40(2)(m) · s. 11(1)the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11
40(2)(n) · s. 12(3)the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12
40(2)(o) · s. 13(2)the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13
40(2)(p) · s. 14(1)the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14
40(2)(q) · s. 17(2)(b)the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17
40(2)(r) · s. 19(2)the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19
40(2)(s) · s. 20(1)the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20
40(2)(t) · s. 23(1)the manner of authentication of orders, directions and instruments under sub-section (1) of section 23
40(2)(u) · s. 24the terms and conditions of appointment and service of officers and employees of the Board under section 24
40(2)(v) · s. 28(1)the techno-legal measures to be adopted by the Board under sub-section (1) of section 28
40(2)(w) · s. 28(7)(d)the other matters under clause (d) of sub-section (7) of section 28
40(2)(x) · s. 29(2)the form, manner and fee for filing an appeal under sub-section (2) of section 29
40(2)(y) · s. 29(8)the procedure for dealing an appeal under sub-section (8) of section 29

Commencement is a separate question from mapping. A rule and the section it operationalises can commence on different dates. Rules 1, 2 and 17 to 21 and sections 19, 20, 23 and 24 are in force now, and Rule 4 with section 6(9) sits in the 1 year group. Most of the operative rules and sections here sit in the group commencing 18 months after publication, computed to 13 May 2027 and interpretation until officially confirmed. For what operates today see what is in force in 2026, and for why that date is quoted 2 ways see the 13 or 14 May question.

Sources cited on this page

[1]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), p. 24. Published 13 November 2025. Official source ↗ · Official requirement · Verified 24 August 2026The enacting formula of G.S.R. 846(E) names both limbs of section 40 as the power under which the whole set of Rules was made.
[2]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 40, p. 18. Published 11 August 2023. Official source ↗ · Official requirement · Verified 24 August 2026Section 40(1) is the general rule making power and section 40(2) enumerates its matters in clauses (a) to (z). Section 40 begins on Gazette page 18 and its clauses (p) to (z) are printed on page 19. Each clause from (a) to (y) names the Act provision it authorises rules for; clause (z) is residual and names none.
[3]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 40(2)(z), p. 19. Published 11 August 2023. Official source ↗ · Official requirement · Verified 24 August 2026The residual clause, quoted as printed on Gazette page 19. Reading a rule whose provision no clause names as resting on the general power in section 40(1) with this clause is this site's reading of the 2 instruments, not a statement either of them makes.
[4]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 12, p. 29. Published 13 November 2025. Official source ↗ · Official requirement · Verified 24 August 2026Rule 12 names section 9 in its own text, disapplying sub sections (1) and (3) of section 9 for the classes and purposes in the Fourth Schedule, so its link to section 9 does not depend on reading subject matter. Pairing it to the enabling sub section 9(4) and to clause 40(2)(j) is still a subject matter reading.
[5]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ · Official requirement · Verified 24 August 2026As printed on Gazette page 24. Corrigendum G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette, and the computation is unaffected. Rule 1(2) brings Rules 1, 2 and 17 to 21 into force on publication and Rule 1(3) brings Rule 4 into force 1 year later.
[6]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ · Official requirement · Verified 24 August 2026Paragraph (c) of G.S.R. 843(E) places sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, sections 28 to 34 and sections 36 and 37 in the 18 month group, which covers every Act provision mapped here except those named in paragraphs (a) and (b). Paragraph (a) brings sections 18 to 26 into force on publication, which covers sections 19, 20, 23 and 24, and paragraph (b) puts section 6(9) in the 1 year group.
[7]Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ · Interpretation, requires judgment · Verified 24 August 2026The calendar date 13 May 2027 is computed from the publication date printed on Gazette issue No. 760 and on Gazette issue No. 757, 13 November 2025, plus 18 months. It is presented as interpretation until officially confirmed, because the official text states a period rather than a date.
[8]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 40(2), p. 18. Published 11 August 2023. Official source ↗ · Interpretation, requires judgment · Verified 24 August 2026Pairing a numbered rule with a clause of section 40(2) is this site's reading of subject matter. The Rules do not cite clause letters against individual rules, and neither instrument publishes a concordance. The clause texts themselves are official and quoted; the pairing is interpretation. Rule 12 is the 1 case where a rule's own text names the Act section it operationalises, and it names sub sections (1) and (3) of section 9 rather than the enabling sub section 9(4). Rule 19(9) also names section 27 of the Act, but only to identify what triggers a Board inquiry.