Home / Digital Personal Data Protection Act, 2023 / Section 36

Section 36 of Digital Personal Data Protection Act, 2023 - Power to Call for Information

Section 36 gives the Central Government a statutory power to require specified persons and bodies to furnish information for the purposes of the Digital Personal Data Protection Act, 2023.

Commencement status: As on 24 September 2026, Section 36 has been enacted but is not yet in force. Under the Central Government notification dated 13 November 2025, Section 36 is scheduled to commence eighteen months from publication of that notification, i.e. on 13 May 2027.

Text of Section 36 - Power to call for information

Section 36. The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

Meaning and scope of Section 36

The provision is an information-gathering power vested in the Central Government. Its use is expressly linked to the purposes of the Digital Personal Data Protection Act, 2023. The section identifies three categories from which information may be required: the Data Protection Board of India, a Data Fiduciary and an intermediary.

Section 36 does not itself prescribe a particular form of request, a fixed category of information, or a separate procedure for every request. Its operative limitation is that the information must be called for for the purposes of the Act. The provision should therefore be read with the Act as a whole and with applicable rules and notifications.

Important terms used in Section 36

Central Government

The power under Section 36 belongs to the Central Government. The section enables the Government to call for information needed for purposes connected with administration and implementation of the Act.

Board

The expression "Board" means the Data Protection Board of India established under Section 18 of the Act. The Board is the statutory body constituted for functions assigned to it under the DPDP Act.

Data Fiduciary

Under Section 2(i), a "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing personal data. Section 36 therefore extends to entities that determine why and how personal data is processed.

Intermediary

The DPDP Act provides that words and expressions not defined in it but defined in the Information Technology Act, 2000 shall have the meanings assigned to them in that Act. The term "intermediary" is defined in Section 2(1)(w) of the Information Technology Act, 2000 and broadly covers a person who, on behalf of another person, receives, stores or transmits an electronic record or provides services relating to that record.

Practical effect of the provision

The Central Government may seek information from the Data Protection Board of India.
It may require a Data Fiduciary to furnish information for purposes of the Act.
It may also require an intermediary to furnish relevant information.
The statutory power is purpose-linked and is not expressed as a general information-demand power unrelated to the DPDP Act.

Current legal position: The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with phased commencement. Because Section 36 itself is scheduled to come into force only after the eighteen-month period, this page distinguishes the enacted text from its present commencement status.

Official resources

For the authoritative text and current notifications, refer to the Digital Personal Data Protection Act, 2023 - official Gazette copy and the Digital Personal Data Protection Rules, 2025 and related notifications published by the Ministry of Electronics and Information Technology.

Last reviewed: 24 September 2026. This page is intended as a general legal information resource. Always verify the latest Gazette notifications, rules and amendments before relying on a provision for a specific matter.