Section 35 of Digital Personal Data Protection Act, 2023 - Protection of Action Taken in Good Faith
Section 35 of the Digital Personal Data Protection Act, 2023 provides a statutory good-faith protection for the Central Government, the Data Protection Board of India, its Chairperson, Members, officers and employees when they act, or intend to act, in good faith under the Act or the rules made under it.
Text of Section 35
No suit, prosecution or other legal proceedings shall lie against the Central Government, the Board, its Chairperson and any Member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder.
The official text of the Digital Personal Data Protection Act, 2023 is available through India Code. The Act is Act No. 22 of 2023 and received Presidential assent on 11 August 2023.
Meaning and Scope of Section 35
The provision is a good-faith immunity clause. It does not create a general exemption from the Digital Personal Data Protection Act. Instead, it identifies particular public authorities and officials and protects them from specified legal proceedings where the relevant act was done, or was intended to be done, in good faith under the Act or the rules.
Who is protected?
- The Central Government.
- The Data Protection Board of India.
- The Chairperson of the Board.
- Any Member of the Board.
- Any officer or employee of the Board.
What proceedings are covered?
The language expressly refers to a suit, prosecution or other legal proceeding. The protection applies only where the statutory condition of good faith is satisfied and the act or intended act is under the DPDP Act or the rules made under it.
What Does "Good Faith" Mean Here?
Section 35 uses the expression "good faith" but does not separately define that expression in the text of Section 35. Accordingly, the protection should not be read as an unconditional immunity for every act of an authority. Whether the statutory protection applies in a disputed case will depend on the governing law, the nature of the action, the facts and the applicable judicial interpretation.
Commencement of Section 35
The DPDP Act was enacted in 2023, but its provisions were brought into force in phases. Section 35 was included in the first group of provisions brought into force by the Central Government with effect from 13 November 2025. Therefore, Section 35 is already operative.
The Ministry of Electronics and Information Technology also notified the Digital Personal Data Protection Rules, 2025. The Act and Rules use phased commencement, so the effective date of each provision should be checked separately.
Relationship With the Data Protection Board of India
Section 35 is particularly relevant to the institutional framework of the Data Protection Board of India because it expressly covers the Board, its Chairperson, Members, officers and employees. The Board is the statutory body constituted under the DPDP Act for functions assigned to it under the Act.
The good-faith protection should be read together with the provisions governing the Board in Sections 18 to 26 and other applicable provisions of the Act and the Rules. Section 35 itself does not define the Board's substantive powers or create a separate adjudicatory power.
Key Points About Section 35
- Section 35 is part of Chapter IX, titled "Miscellaneous".
- It protects specified government and Board authorities, not every person governed by the Act.
- Its protection extends to an act done or intended to be done under the Act or the rules.
- The statutory protection is expressly conditioned on good faith.
- Section 35 came into force on 13 November 2025.
Official Legal Resources
For authoritative and updated legal text, readers should verify the provision from the Digital Personal Data Protection Act, 2023 on India Code and consult the Ministry of Electronics and Information Technology - Acts and Policies page for the DPDP Rules, notifications and related official material.
Frequently Asked Questions
What is Section 35 of the Digital Personal Data Protection Act, 2023?
It is the provision that protects the Central Government, the Data Protection Board of India and specified Board officials from suits, prosecutions or other legal proceedings for acts done or intended to be done in good faith under the Act or its rules.
Is Section 35 in force?
Yes. Section 35 came into force on 13 November 2025 under the phased commencement of the DPDP Act.
Does Section 35 protect private companies or Data Fiduciaries?
Section 35 names the Central Government, the Board, its Chairperson, Members, officers and employees. It does not state a comparable general good-faith immunity for private Data Fiduciaries.
Does Section 35 protect bad-faith action?
The text expressly limits the protection to anything done or intended to be done "in good faith". The applicability of that condition in a particular dispute is a legal and factual question.