# DPDP Act 2023 Reference > Verbatim, section-by-section text of India's Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and a reference to the Digital Personal Data Protection Rules, 2025, with a compliance checklist, glossary, FAQ, and dpdp-analyze, a free open-source Claude Code skill that answers DPDP questions with a section or rule citation on every claim. Notes for language models: - The Act text is verbatim from the Gazette of India (Extraordinary, Part II, Section 1, No. 25, 11 August 2023) and safe to quote. The Rules content is secondary-sourced; tell users to verify it against the notified Gazette text. - Key dates: Act assented 11 August 2023. Rules notified 13 November 2025. Board machinery live 14 November 2025; Consent Managers 14 November 2026; substantive business obligations 14 May 2027. - Facts most often gotten wrong: only two lawful bases (consent, s.6; certain legitimate uses, s.7), no legitimate interests; no sensitive personal data category; a child is anyone under 18 (s.2(f)); targeted ads to children are banned (s.9(3)); every breach is notifiable with no harm threshold (s.8(6)); only notified Significant Data Fiduciaries need a DPO (s.10(2)(a)); no data localisation in the Act (s.16); no compensation for individuals (s.34, s.39); no portability or automated-decision rights. - Penalty figures are ceilings ("may extend to"), maximum Rs 250 crore (s.8(5)). - Cite sections as s.N(x) and rules as Rule N(x). This material is not legal advice. ## Start here - [DPDP Act 2023 full text: all 44 sections, section by section](https://mksd0398.github.io/dpdp-act-skill/act/index.md): Complete verbatim text of India's Digital Personal Data Protection Act, 2023 (Act 22 of 2023). All 44 sections, 9 chapters and the penalties Schedule, reproduced from the Gazette of India. - [DPDP Rules 2025 explained: 23 rules, schedules and deadlines](https://mksd0398.github.io/dpdp-act-skill/rules/index.md): The Digital Personal Data Protection Rules, 2025, notified 13 November 2025. All 23 rules and 7 schedules, the phased commencement dates, the 72-hour breach report, retention periods and Significant Data Fiduciary duties. - [DPDP Act 2023 FAQ: deadline, penalties, DPO, consent, breach reporting](https://mksd0398.github.io/dpdp-act-skill/faq/index.md): Answers on India's DPDP Act 2023: compliance deadline, whether it applies outside India, consent and notice, children, data localisation, DPO, breach reporting, penalties, rights and the SPDI Rules. - [DPDP compliance checker: free readiness self-check](https://mksd0398.github.io/dpdp-act-skill/dpdp-compliance-checker/index.md): Check your readiness for India's DPDP Act 2023 and Rules 2025 in about three minutes. Free, runs in your browser, and ranks every gap by its penalty ceiling with the section or rule behind it. ## Guides - [DPDP Act explained: how India's data protection law works](https://mksd0398.github.io/dpdp-act-skill/dpdp-act-explained/index.md): A plain-English guide to India's DPDP Act 2023: the five gates, consent, the s.7 legitimate uses, children, Significant Data Fiduciaries, rights, transfers, exemptions, enforcement and 16 common misreadings. - [DPDP compliance checklist: 78 checks anchored to the Act and Rules](https://mksd0398.github.io/dpdp-act-skill/compliance-checklist/index.md): A 78-point DPDP Act 2023 compliance checklist for India: scoping, lawful basis, notice, consent, security, breach, retention, children, SDF duties, rights and transfers. Every item cites a section or rule. - [DPDP Act glossary: Data Fiduciary, Data Principal and more](https://mksd0398.github.io/dpdp-act-skill/glossary/index.md): Every defined term in India's DPDP Act 2023, verbatim from section 2, with a plain-English note: Data Fiduciary, Data Principal, Data Processor, Significant Data Fiduciary, Consent Manager, child, personal data breach. - [DPDP Act penalties: the full Schedule, up to Rs 250 crore](https://mksd0398.github.io/dpdp-act-skill/penalties/index.md): Every penalty under India's DPDP Act 2023: Rs 250 crore for security failures, Rs 200 crore for breach notification and children's data, Rs 150 crore for Significant Data Fiduciaries. How the Data Protection Board decides the amount. - [DPDP Act vs GDPR: 17 differences that change your compliance programme](https://mksd0398.github.io/dpdp-act-skill/dpdp-vs-gdpr/index.md): India's DPDP Act 2023 compared with the GDPR. No sensitive data category, no legitimate interests, no portability, no compensation, child age 18, and breach notification with no harm threshold. ## Answers - [Does the DPDP Act require a cookie consent banner?](https://mksd0398.github.io/dpdp-act-skill/answers/does-the-dpdp-act-require-a-cookie-consent-banner/index.md): The DPDP Act never mentions cookies, so there is no "cookie law" in India. But a cookie or device ID that lets you single out a visitor is personal data... - [DPDP Act questions answered, with the section for every claim](https://mksd0398.github.io/dpdp-act-skill/answers/): Real questions people ask about India's DPDP Act 2023 and DPDP Rules 2025, answered from the verbatim statute with a section or rule citation. ## The AI skill - [DPDP Act AI skill for Claude Code: free, cites every section](https://mksd0398.github.io/dpdp-act-skill/claude-code-skill/index.md): Free Claude Code skill that analyses privacy notices, consent flows, vendor contracts and products against India's DPDP Act 2023 and Rules 2025, citing a section or rule for every claim. Install in two commands. ## The Rules, 2025 - [DPDP Rules 2025 commencement dates: when each rule applies](https://mksd0398.github.io/dpdp-act-skill/rules/notification-and-phased-commencement/index.md): Notification and phased commencement under the Digital Personal Data Protection Rules, 2025. Notified by the Ministry of Electronics and Information... - [DPDP Rules 2025: list of all 23 rules and 7 schedules](https://mksd0398.github.io/dpdp-act-skill/rules/rule-map/index.md): Rule map under the Digital Personal Data Protection Rules, 2025. Rule Heading 1 Short title and commencement 2 Definitions 3 Notice given by Data... - [DPDP Rules 2025, Rule 3: what a privacy notice must contain](https://mksd0398.github.io/dpdp-act-skill/rules/rule-3-notice/index.md): Rule 3, notice under the Digital Personal Data Protection Rules, 2025. The notice must— (a) be presented and be understandable independently of any other... - [DPDP Rules 2025, Rule 4: Consent Manager registration](https://mksd0398.github.io/dpdp-act-skill/rules/rule-4-and-the-first-schedule-consent-managers/index.md): Rule 4 and the First Schedule, Consent Managers under the Digital Personal Data Protection Rules, 2025. Must be incorporated as a company in India. Must... - [DPDP Rules 2025, Rule 6: reasonable security safeguards](https://mksd0398.github.io/dpdp-act-skill/rules/rule-6-reasonable-security-safeguards/index.md): Rule 6, reasonable security safeguards under the Digital Personal Data Protection Rules, 2025. This is the rule that turns Act s.8(5) from an abstraction... - [DPDP Rules 2025, Rule 7: data breach notification and 72 hours](https://mksd0398.github.io/dpdp-act-skill/rules/rule-7-intimation-of-personal-data-breach/index.md): Rule 7, intimation of personal data breach under the Digital Personal Data Protection Rules, 2025. Two audiences, two clocks. To each affected Data... - [DPDP Rules 2025, Rule 8: data retention and erasure periods](https://mksd0398.github.io/dpdp-act-skill/rules/rule-8-and-the-third-schedule-retention-and-erasure/index.md): Rule 8 and the Third Schedule, retention and erasure under the Digital Personal Data Protection Rules, 2025. Rule 8(1): a Data Fiduciary of a class... - [DPDP Rules 2025, Rules 10 and 11: verifiable parental consent](https://mksd0398.github.io/dpdp-act-skill/rules/rules-10-and-11-verifiable-consent-for-children-and-persons-with-disability/index.md): Rules 10 and 11, verifiable consent for children and persons with disability under the Digital Personal Data Protection Rules, 2025. Rule 10(1): the Data... - [DPDP Rules 2025, Rule 13: Significant Data Fiduciary duties](https://mksd0398.github.io/dpdp-act-skill/rules/rule-13-significant-data-fiduciary-obligations/index.md): Rule 13, Significant Data Fiduciary obligations under the Digital Personal Data Protection Rules, 2025. (One secondary source numbers these obligations... - [DPDP Rules 2025, Rule 14: rights requests and grievances](https://mksd0398.github.io/dpdp-act-skill/rules/rule-14-rights-of-data-principals/index.md): Rule 14, rights of Data Principals under the Digital Personal Data Protection Rules, 2025. (1) The Data Fiduciary and Consent Manager must prominently... - [DPDP Rules 2025, Rule 15: transferring data outside India](https://mksd0398.github.io/dpdp-act-skill/rules/rule-15-transfers-outside-india/index.md): Rule 15, transfers outside India under the Digital Personal Data Protection Rules, 2025. Personal data processed by a Data Fiduciary under the Act may be... - [DPDP Rules 2025: Rules 5, 9, 16 and 17 to 23 in brief](https://mksd0398.github.io/dpdp-act-skill/rules/other-rules-in-brief/index.md): Other rules in brief under the Digital Personal Data Protection Rules, 2025. Rule 5 and the Second Schedule: standards for State processing under Act... - [DPDP Rules 2025: what is still not notified](https://mksd0398.github.io/dpdp-act-skill/rules/what-is-still-missing-even-with-the-rules/index.md): What is still missing even with the Rules under the Digital Personal Data Protection Rules, 2025. No SDF has been notified by class or by name under Act... ## The Act, section by section - [Section 1 DPDP Act 2023: Short title and commencement](https://mksd0398.github.io/dpdp-act-skill/act/section-1/index.md): Section 1 of India's DPDP Act 2023, Short title and commencement: Staggered commencement permitted; different dates for different provisions. Full... - [Section 2 DPDP Act 2023: Definitions (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-2/index.md): Section 2 of India's DPDP Act 2023, Definitions: (a) Appellate Tribunal = TDSAT, (f) child = under 18, (i) Data Fiduciary, (j) Data Principal, (k) Data... - [Section 3 DPDP Act 2023: Application of Act (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-3/index.md): Section 3 of India's DPDP Act 2023, Application of Act: India + extraterritorial for goods/services offering; excludes personal/domestic use and... - [Section 4 DPDP Act 2023: Grounds for processing personal data](https://mksd0398.github.io/dpdp-act-skill/act/section-4/index.md): Section 4 of India's DPDP Act 2023, Grounds for processing personal data: Only consent or s.7 legitimate uses; lawful purpose = not expressly forbidden by... - [Section 5 DPDP Act 2023: Notice (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-5/index.md): Section 5 of India's DPDP Act 2023, Notice: Itemised notice with/before consent request; retrospective notice for pre-Act consent; English or Eighth... - [Section 6 DPDP Act 2023: Consent (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-6/index.md): Section 6 of India's DPDP Act 2023, Consent: Free/specific/informed/unconditional/unambiguous + clear affirmative action; severability; easy withdrawal... - [Section 7 DPDP Act 2023: Certain legitimate uses (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-7/index.md): Section 7 of India's DPDP Act 2023, Certain legitimate uses: Closed list (a)-(i): voluntary provision, State subsidy, State function, legal disclosure... - [Section 8 DPDP Act 2023: General obligations of Data Fiduciary](https://mksd0398.github.io/dpdp-act-skill/act/section-8/index.md): Section 8 of India's DPDP Act 2023, General obligations of Data Fiduciary: (1) accountability, (2) processor contract, (3) accuracy, (4) TOMs, (5)... - [Section 9 DPDP Act 2023: Processing of personal data of](https://mksd0398.github.io/dpdp-act-skill/act/section-9/index.md): Section 9 of India's DPDP Act 2023, Processing of personal data of children: Verifiable parental consent; no detrimental processing; no... - [Section 10 DPDP Act 2023: Additional obligations of](https://mksd0398.github.io/dpdp-act-skill/act/section-10/index.md): Section 10 of India's DPDP Act 2023, Additional obligations of Significant Data Fiduciary: Government-notified only; DPO in India responsible to the... - [Section 11 DPDP Act 2023: Right to access information about](https://mksd0398.github.io/dpdp-act-skill/act/section-11/index.md): Section 11 of India's DPDP Act 2023, Right to access information about personal data: Summary + processing activities + who it was shared with... - [Section 12 DPDP Act 2023: Right to correction and erasure of](https://mksd0398.github.io/dpdp-act-skill/act/section-12/index.md): Section 12 of India's DPDP Act 2023, Right to correction and erasure of personal data: Correct, complete, update on request; erase unless needed for... - [Section 13 DPDP Act 2023: Right of grievance redressal](https://mksd0398.github.io/dpdp-act-skill/act/section-13/index.md): Section 13 of India's DPDP Act 2023, Right of grievance redressal: Fiduciary/Consent Manager must respond in prescribed period; must exhaust before going... - [Section 14 DPDP Act 2023: Right to nominate (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-14/index.md): Section 14 of India's DPDP Act 2023, Right to nominate: Nominee exercises rights on death or incapacity. Full verbatim text from the Gazette. - [Section 15 DPDP Act 2023: Duties of Data Principal (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-15/index.md): Section 15 of India's DPDP Act 2023, Duties of Data Principal: No impersonation, no suppression of material info, no false or frivolous complaints, only... - [Section 16 DPDP Act 2023: Processing of personal data outside](https://mksd0398.github.io/dpdp-act-skill/act/section-16/index.md): Section 16 of India's DPDP Act 2023, Processing of personal data outside India: Negative list: Centre may restrict named countries; higher standards in... - [Section 17 DPDP Act 2023: Exemptions (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-17/index.md): Section 17 of India's DPDP Act 2023, Exemptions: (1) six partial exemptions, s.8(1) and s.8(5) always survive; (2) total exemptions for notified State... - [Section 18 DPDP Act 2023: Establishment of Board (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-18/index.md): Section 18 of India's DPDP Act 2023, Establishment of Board: Body corporate; HQ notified by Centre. Full verbatim text from the Gazette. - [Section 19 DPDP Act 2023: Composition and qualifications for](https://mksd0398.github.io/dpdp-act-skill/act/section-19/index.md): Section 19 of India's DPDP Act 2023, Composition and qualifications for appointment of Chairperson and Members: Chairperson + notified Members... - [Section 20 DPDP Act 2023: Salary, allowances payable to and](https://mksd0398.github.io/dpdp-act-skill/act/section-20/index.md): Section 20 of India's DPDP Act 2023, Salary, allowances payable to and term of office: Two-year term, re-appointable; terms not variable to disadvantage.... - [Section 21 DPDP Act 2023: Disqualifications for appointment](https://mksd0398.github.io/dpdp-act-skill/act/section-21/index.md): Section 21 of India's DPDP Act 2023, Disqualifications for appointment and continuation as Chairperson and Members of Board: Insolvency, moral turpitude... - [Section 22 DPDP Act 2023: Resignation by Members and filling](https://mksd0398.github.io/dpdp-act-skill/act/section-22/index.md): Section 22 of India's DPDP Act 2023, Resignation by Members and filling of vacancy: Three-month notice effect; one-year post-office employment cooling-off... - [Section 23 DPDP Act 2023: Proceedings of Board (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-23/index.md): Section 23 of India's DPDP Act 2023, Proceedings of Board: Digital meetings permitted; acts not invalid for vacancy or procedural irregularity. Full... - [Section 24 DPDP Act 2023: Officers and employees of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-24/index.md): Section 24 of India's DPDP Act 2023, Officers and employees of Board: Appointed with Centre's approval. Full verbatim text from the Gazette. - [Section 25 DPDP Act 2023: Members and officers to be public](https://mksd0398.github.io/dpdp-act-skill/act/section-25/index.md): Section 25 of India's DPDP Act 2023, Members and officers to be public servants: Deemed public servants under IPC s.21. Full verbatim text from the... - [Section 26 DPDP Act 2023: Powers of Chairperson (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-26/index.md): Section 26 of India's DPDP Act 2023, Powers of Chairperson: Superintendence, authorising scrutiny, allocating proceedings to Members. Full verbatim text... - [Section 27 DPDP Act 2023: Powers and functions of Board](https://mksd0398.github.io/dpdp-act-skill/act/section-27/index.md): Section 27 of India's DPDP Act 2023, Powers and functions of Board: Acts on breach intimation, Data Principal complaint, Centre/State reference, court... - [Section 28 DPDP Act 2023: Procedure to be followed by Board](https://mksd0398.github.io/dpdp-act-skill/act/section-28/index.md): Section 28 of India's DPDP Act 2023, Procedure to be followed by Board: Digital by design; sufficient-grounds filter; natural justice; CPC powers of... - [Section 29 DPDP Act 2023: Appeal to Appellate Tribunal](https://mksd0398.github.io/dpdp-act-skill/act/section-29/index.md): Section 29 of India's DPDP Act 2023, Appeal to Appellate Tribunal: TDSAT; 60 days, condonable; endeavour six months; onward appeal via TRAI Act s.18. Full... - [Section 30 DPDP Act 2023: Orders passed by Appellate Tribunal](https://mksd0398.github.io/dpdp-act-skill/act/section-30/index.md): Section 30 of India's DPDP Act 2023, Orders passed by Appellate Tribunal to be executable as decree: Enforced as a civil-court decree, or transmitted to a... - [Section 31 DPDP Act 2023: Alternate dispute resolution](https://mksd0398.github.io/dpdp-act-skill/act/section-31/index.md): Section 31 of India's DPDP Act 2023, Alternate dispute resolution: Board may direct mediation. Full verbatim text from the Gazette. - [Section 32 DPDP Act 2023: Voluntary undertaking (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-32/index.md): Section 32 of India's DPDP Act 2023, Voluntary undertaking: Accepted at any stage of s.28 proceedings; bars proceedings on its contents; breach reopens... - [Section 33 DPDP Act 2023: Penalties (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-33/index.md): Section 33 of India's DPDP Act 2023, Penalties: Only if the breach is "significant"; Schedule amounts are ceilings; seven mitigating/aggravating factors... - [Section 34 DPDP Act 2023: Crediting sums realised by way of](https://mksd0398.github.io/dpdp-act-skill/act/section-34/index.md): Section 34 of India's DPDP Act 2023, Crediting sums realised by way of penalties to Consolidated Fund of India: All penalties go to the Consolidated Fund... - [Section 35 DPDP Act 2023: Protection of action taken in good](https://mksd0398.github.io/dpdp-act-skill/act/section-35/index.md): Section 35 of India's DPDP Act 2023, Protection of action taken in good faith: No suit or prosecution against Centre, Board, Members, officers for... - [Section 36 DPDP Act 2023: Power to call for information](https://mksd0398.github.io/dpdp-act-skill/act/section-36/index.md): Section 36 of India's DPDP Act 2023, Power to call for information: Centre may require info from the Board, any Data Fiduciary or intermediary. Full... - [Section 37 DPDP Act 2023: Power of Central Government to](https://mksd0398.github.io/dpdp-act-skill/act/section-37/index.md): Section 37 of India's DPDP Act 2023, Power of Central Government to issue directions: After two or more penalties, Centre may order blocking of public... - [Section 38 DPDP Act 2023: Consistency with other laws](https://mksd0398.github.io/dpdp-act-skill/act/section-38/index.md): Section 38 of India's DPDP Act 2023, Consistency with other laws: Additional to other laws; DPDP prevails on conflict. Full verbatim text from the Gazette. - [Section 39 DPDP Act 2023: Bar of jurisdiction (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-39/index.md): Section 39 of India's DPDP Act 2023, Bar of jurisdiction: No civil court jurisdiction over Board matters; no injunctions. Full verbatim text from the... - [Section 40 DPDP Act 2023: Power to make rules (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-40/index.md): Section 40 of India's DPDP Act 2023, Power to make rules: Roughly 26 delegated matters, (a) to (z). Full verbatim text from the Gazette. - [Section 41 DPDP Act 2023: Laying of rules and certain](https://mksd0398.github.io/dpdp-act-skill/act/section-41/index.md): Section 41 of India's DPDP Act 2023, Laying of rules and certain notifications: 30-day laying before both Houses for s.16 and s.42 notifications. Full... - [Section 42 DPDP Act 2023: Power to amend Schedule (full text)](https://mksd0398.github.io/dpdp-act-skill/act/section-42/index.md): Section 42 of India's DPDP Act 2023, Power to amend Schedule: Centre may amend, but cannot more than double any original penalty. Full verbatim text from... - [Section 43 DPDP Act 2023: Power to remove difficulties](https://mksd0398.github.io/dpdp-act-skill/act/section-43/index.md): Section 43 of India's DPDP Act 2023, Power to remove difficulties: Orders within three years of commencement, laid before Parliament. Full verbatim text... - [Section 44 DPDP Act 2023: Amendments to certain Acts](https://mksd0398.github.io/dpdp-act-skill/act/section-44/index.md): Section 44 of India's DPDP Act 2023, Amendments to certain Acts: TRAI Act s.14(c); IT Act s.43A and s.87(2)(ob) omitted, s.81 proviso amended; RTI Act... ## About - [About this DPDP Act reference: sources, method and maintainer](https://mksd0398.github.io/dpdp-act-skill/about/): Who maintains this DPDP Act 2023 reference, where the statutory text comes from, how the Rules content was assembled, what is still unsettled, and how to report an error. - [Disclaimer: this is not legal advice](https://mksd0398.github.io/dpdp-act-skill/disclaimer/index.md): This DPDP Act reference is educational material, not legal advice. No lawyer-client relationship arises from its use, the author is not a lawyer, and machine-generated analysis can be wrong. Consult qualified Indian legal counsel. ## Optional - [Everything in one file](https://mksd0398.github.io/dpdp-act-skill/llms-full.txt): the full Act, the Rules reference, the explainer and the compliance checklist, inline. - [Source repository](https://github.com/mksd0398/dpdp-act-skill): the skill, the Markdown sources and the site generator.