All 44 sections of the Digital Personal Data Protection Act, 2023. Each with DPDP Rules 2025 cross-references, implementation notes, and common compliance gaps.
First 3 sections are fully open. Continue reading by providing your email.
The Digital Personal Data Protection Act, 2023 has 44 Sections organised across chapters covering applicability (Section 3), data fiduciary obligations (Sections 4-10), data principal rights and duties (Sections 11-15), consent managers (Section 6(7) to 6(9)), exemptions (Section 17), the Data Protection Board (Sections 18-28), appeals (Section 29), penalties (Section 33), and transitional provisions.
The most operationally significant sections are: Section 3 (applicability including extraterritorial scope), Section 5 (notice), Section 6 (consent), Section 7 (deemed consent/legitimate uses), Section 8 (data fiduciary obligations including breach notification), Section 9 (children's data), Section 10 (Significant Data Fiduciary), Section 11 (data principal rights), Section 16 (cross border transfers), and Section 33 (penalties up to ₹250 Crore).
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on DPDPA Deep Dive under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].
Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for DPDPA Deep Dive rather than a generic checklist.
Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.