# DPDP Act 2023 full text: all 44 sections, section by section

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/act/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), assented 11 August 2023. 44 sections in 9 chapters plus a Schedule of penalties.

- [Section 1. Short title and commencement](https://mksd0398.github.io/dpdp-act-skill/act/section-1/index.md): Staggered commencement permitted; different dates for different provisions
- [Section 2. Definitions](https://mksd0398.github.io/dpdp-act-skill/act/section-2/index.md): (a) Appellate Tribunal = TDSAT, (f) child = under 18, (i) Data Fiduciary, (j) Data Principal, (k) Data Processor, (t) personal data, (u) personal data breach, (x) processing, (y) "she" is gender-neutral, (z) SDF
- [Section 3. Application of Act](https://mksd0398.github.io/dpdp-act-skill/act/section-3/index.md): India + extraterritorial for goods/services offering; excludes personal/domestic use and self-published data
- [Section 4. Grounds for processing personal data](https://mksd0398.github.io/dpdp-act-skill/act/section-4/index.md): Only consent or s.7 legitimate uses; lawful purpose = not expressly forbidden by law
- [Section 5. Notice](https://mksd0398.github.io/dpdp-act-skill/act/section-5/index.md): Itemised notice with/before consent request; retrospective notice for pre-Act consent; English or Eighth Schedule language
- [Section 6. Consent](https://mksd0398.github.io/dpdp-act-skill/act/section-6/index.md): Free/specific/informed/unconditional/unambiguous + clear affirmative action; severability; easy withdrawal; Consent Managers; burden of proof on Fiduciary (6(10))
- [Section 7. Certain legitimate uses](https://mksd0398.github.io/dpdp-act-skill/act/section-7/index.md): Closed list (a)-(i): voluntary provision, State subsidy, State function, legal disclosure, court orders, medical emergency, epidemic, disaster, employment
- [Section 8. General obligations of Data Fiduciary](https://mksd0398.github.io/dpdp-act-skill/act/section-8/index.md): (1) accountability, (2) processor contract, (3) accuracy, (4) TOMs, (5) security, (6) breach notice to Board + each individual, (7) erasure, (8)+(11) deemed purpose expiry, (9) publish contact, (10) grievance mechanism
- [Section 9. Processing of personal data of children](https://mksd0398.github.io/dpdp-act-skill/act/section-9/index.md): Verifiable parental consent; no detrimental processing; no tracking/behavioural monitoring/targeted ads; Rules may exempt (1) and (3) only; s.9(5) age notification
- [Section 10. Additional obligations of Significant Data Fiduciary](https://mksd0398.github.io/dpdp-act-skill/act/section-10/index.md): Government-notified only; DPO in India responsible to the board; independent data auditor; periodic DPIA and audit
- [Section 11. Right to access information about personal data](https://mksd0398.github.io/dpdp-act-skill/act/section-11/index.md): Summary + processing activities + who it was shared with; law-enforcement sharing carved out
- [Section 12. Right to correction and erasure of personal data](https://mksd0398.github.io/dpdp-act-skill/act/section-12/index.md): Correct, complete, update on request; erase unless needed for purpose or law
- [Section 13. Right of grievance redressal](https://mksd0398.github.io/dpdp-act-skill/act/section-13/index.md): Fiduciary/Consent Manager must respond in prescribed period; must exhaust before going to the Board
- [Section 14. Right to nominate](https://mksd0398.github.io/dpdp-act-skill/act/section-14/index.md): Nominee exercises rights on death or incapacity
- [Section 15. Duties of Data Principal](https://mksd0398.github.io/dpdp-act-skill/act/section-15/index.md): No impersonation, no suppression of material info, no false or frivolous complaints, only authentic info; penalty up to Rs 10,000
- [Section 16. Processing of personal data outside India](https://mksd0398.github.io/dpdp-act-skill/act/section-16/index.md): Negative list: Centre may restrict named countries; higher standards in other Indian law preserved
- [Section 17. Exemptions](https://mksd0398.github.io/dpdp-act-skill/act/section-17/index.md): (1) six partial exemptions, s.8(1) and s.8(5) always survive; (2) total exemptions for notified State bodies and research/archiving/statistics; (3) startup relief from s.5, s.8(3), s.8(7), s.10, s.11; (4) State retention/correction carve-out; (5) five-year sunset power
- [Section 18. Establishment of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-18/index.md): Body corporate; HQ notified by Centre
- [Section 19. Composition and qualifications for appointment of Chairperson and Members](https://mksd0398.github.io/dpdp-act-skill/act/section-19/index.md): Chairperson + notified Members, Centre-appointed; at least one legal expert
- [Section 20. Salary, allowances payable to and term of office](https://mksd0398.github.io/dpdp-act-skill/act/section-20/index.md): Two-year term, re-appointable; terms not variable to disadvantage
- [Section 21. Disqualifications for appointment and continuation as Chairperson and Members of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-21/index.md): Insolvency, moral turpitude, incapacity, conflicting interest, abuse of position; hearing before removal
- [Section 22. Resignation by Members and filling of vacancy](https://mksd0398.github.io/dpdp-act-skill/act/section-22/index.md): Three-month notice effect; one-year post-office employment cooling-off with disclosure
- [Section 23. Proceedings of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-23/index.md): Digital meetings permitted; acts not invalid for vacancy or procedural irregularity
- [Section 24. Officers and employees of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-24/index.md): Appointed with Centre's approval
- [Section 25. Members and officers to be public servants](https://mksd0398.github.io/dpdp-act-skill/act/section-25/index.md): Deemed public servants under IPC s.21
- [Section 26. Powers of Chairperson](https://mksd0398.github.io/dpdp-act-skill/act/section-26/index.md): Superintendence, authorising scrutiny, allocating proceedings to Members
- [Section 27. Powers and functions of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-27/index.md): Acts on breach intimation, Data Principal complaint, Centre/State reference, court direction, Consent Manager breach, s.37(2) intermediary reference; can issue binding directions after hearing
- [Section 28. Procedure to be followed by Board](https://mksd0398.github.io/dpdp-act-skill/act/section-28/index.md): Digital by design; sufficient-grounds filter; natural justice; CPC powers of summons/evidence/discovery/inspection; cannot bar premises or seize equipment; interim orders; costs for frivolous complaints
- [Section 29. Appeal to Appellate Tribunal](https://mksd0398.github.io/dpdp-act-skill/act/section-29/index.md): TDSAT; 60 days, condonable; endeavour six months; onward appeal via TRAI Act s.18
- [Section 30. Orders passed by Appellate Tribunal to be executable as decree](https://mksd0398.github.io/dpdp-act-skill/act/section-30/index.md): Enforced as a civil-court decree, or transmitted to a civil court
- [Section 31. Alternate dispute resolution](https://mksd0398.github.io/dpdp-act-skill/act/section-31/index.md): Board may direct mediation
- [Section 32. Voluntary undertaking](https://mksd0398.github.io/dpdp-act-skill/act/section-32/index.md): Accepted at any stage of s.28 proceedings; bars proceedings on its contents; breach reopens s.33
- [Section 33. Penalties](https://mksd0398.github.io/dpdp-act-skill/act/section-33/index.md): Only if the breach is "significant"; Schedule amounts are ceilings; seven mitigating/aggravating factors in s.33(2)
- [Section 34. Crediting sums realised by way of penalties to Consolidated Fund of India](https://mksd0398.github.io/dpdp-act-skill/act/section-34/index.md): All penalties go to the Consolidated Fund of India, not to victims
- [Section 35. Protection of action taken in good faith](https://mksd0398.github.io/dpdp-act-skill/act/section-35/index.md): No suit or prosecution against Centre, Board, Members, officers for good-faith acts
- [Section 36. Power to call for information](https://mksd0398.github.io/dpdp-act-skill/act/section-36/index.md): Centre may require info from the Board, any Data Fiduciary or intermediary
- [Section 37. Power of Central Government to issue directions](https://mksd0398.github.io/dpdp-act-skill/act/section-37/index.md): After two or more penalties, Centre may order blocking of public access; intermediaries bound
- [Section 38. Consistency with other laws](https://mksd0398.github.io/dpdp-act-skill/act/section-38/index.md): Additional to other laws; DPDP prevails on conflict
- [Section 39. Bar of jurisdiction](https://mksd0398.github.io/dpdp-act-skill/act/section-39/index.md): No civil court jurisdiction over Board matters; no injunctions
- [Section 40. Power to make rules](https://mksd0398.github.io/dpdp-act-skill/act/section-40/index.md): Roughly 26 delegated matters, (a) to (z)
- [Section 41. Laying of rules and certain notifications](https://mksd0398.github.io/dpdp-act-skill/act/section-41/index.md): 30-day laying before both Houses for s.16 and s.42 notifications
- [Section 42. Power to amend Schedule](https://mksd0398.github.io/dpdp-act-skill/act/section-42/index.md): Centre may amend, but cannot more than double any original penalty
- [Section 43. Power to remove difficulties](https://mksd0398.github.io/dpdp-act-skill/act/section-43/index.md): Orders within three years of commencement, laid before Parliament
- [Section 44. Amendments to certain Acts](https://mksd0398.github.io/dpdp-act-skill/act/section-44/index.md): TRAI Act s.14(c); IT Act s.43A and s.87(2)(ob) omitted, s.81 proviso amended; RTI Act s.8(1)(j) replaced