The Digital Personal Data Protection Act, 2023: full text
Act 22 of 2023. Assented 11 August 2023. All 44 sections across 9 chapters, plus the Schedule of penalties, reproduced verbatim from the Gazette of India, Extraordinary, Part II, Section 1, No. 25.
New to the Act? Start with the DPDP Act explained, or look up a term in the glossary.
CHAPTER I: PRELIMINARY
CHAPTER II: OBLIGATIONS OF DATA FIDUCIARY
- Section 4 Grounds for processing personal data
- Section 5 Notice
- Section 6 Consent
- Section 7 Certain legitimate uses
- Section 8 General obligations of Data Fiduciary
- Section 9 Processing of personal data of children
- Section 10 Additional obligations of Significant Data Fiduciary
CHAPTER III: RIGHTS AND DUTIES OF DATA PRINCIPAL
- Section 11 Right to access information about personal data
- Section 12 Right to correction and erasure of personal data
- Section 13 Right of grievance redressal
- Section 14 Right to nominate
- Section 15 Duties of Data Principal
CHAPTER IV: SPECIAL PROVISIONS
CHAPTER V: DATA PROTECTION BOARD OF INDIA
- Section 18 Establishment of Board
- Section 19 Composition and qualifications for appointment of Chairperson and Members
- Section 20 Salary, allowances payable to and term of office
- Section 21 Disqualifications for appointment and continuation as Chairperson and Members of Board
- Section 22 Resignation by Members and filling of vacancy
- Section 23 Proceedings of Board
- Section 24 Officers and employees of Board
- Section 25 Members and officers to be public servants
- Section 26 Powers of Chairperson
CHAPTER VI: POWERS, FUNCTIONS AND PROCEDURE TO BE FOLLOWED BY BOARD
CHAPTER VII: APPEAL AND ALTERNATE DISPUTE RESOLUTION
- Section 29 Appeal to Appellate Tribunal
- Section 30 Orders passed by Appellate Tribunal to be executable as decree
- Section 31 Alternate dispute resolution
- Section 32 Voluntary undertaking
CHAPTER VIII: PENALTIES AND ADJUDICATION
- Section 33 Penalties
- Section 34 Crediting sums realised by way of penalties to Consolidated Fund of India
CHAPTER IX: MISCELLANEOUS
- Section 35 Protection of action taken in good faith
- Section 36 Power to call for information
- Section 37 Power of Central Government to issue directions
- Section 38 Consistency with other laws
- Section 39 Bar of jurisdiction
- Section 40 Power to make rules
- Section 41 Laying of rules and certain notifications
- Section 42 Power to amend Schedule
- Section 43 Power to remove difficulties
- Section 44 Amendments to certain Acts
The Schedule
THE SCHEDULE
[See section 33 (1)]
| Sl. No. | Breach of provisions of this Act or rules made thereunder | Penalty |
|---|---|---|
| 1. | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2. | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3. | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4. | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to one hundred and fifty crore rupees. |
| 5. | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6. | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7. | Breach of any other provision of this Act or the rules made thereunder. | May extend to fifty crore rupees. |
Signed: DR. REETA VASISHTA, Secretary to the Govt. of India.
Last updated . Report an error.