Section 40 of Digital Personal Data Protection Act, 2023 - Power to Make Rules

Section 40 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") authorises the Central Government to make subordinate rules for carrying out the purposes of the Act. The provision identifies the principal subjects on which detailed rules may be prescribed, including notices, Consent Managers, personal data breaches, children's data, Significant Data Fiduciaries, Data Principal rights, the Data Protection Board of India and appeals.

Current legal position: The Central Government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. The implementation framework is phased, so the commencement notification and the Rules should be checked when determining whether a particular obligation is presently operative.

Meaning and scope of Section 40

Section 40 is the rule-making provision of the DPDP Act. It allows the Central Government, by notification and subject to previous publication, to make rules that are consistent with the Act. These rules supply procedural and operational details for matters that Parliament has left to be prescribed.

The expression "prescribed" in the Act refers to matters prescribed by rules made under the Act. Section 40 therefore works with provisions throughout the DPDP Act that expressly require a manner, form, period, standard, condition, procedure or other detail to be prescribed.

Text and subject matter of Section 40

Section 40(1): The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of the Act to carry out its purposes.

Section 40(2): Without limiting the general rule-making power, rules may provide for the following matters:

  1. the manner in which a Data Fiduciary's notice informs the Data Principal under section 5(1);
  2. the manner in which the notice informs the Data Principal under section 5(2);
  3. the accountability and obligations of a Consent Manager under section 6(8);
  4. registration of a Consent Manager and the related conditions under section 6(9);
  5. the subsidy, benefit, service, certificate, licence or permit for which personal data may be processed under section 7(b);
  6. the form and manner of intimation of a personal data breach to the Board under section 8(6);
  7. the period after which a specified purpose is deemed no longer to be served under section 8(8);
  8. the manner of publishing business contact information of a Data Protection Officer under section 8(9);
  9. the manner of obtaining verifiable consent under section 9(1);
  10. classes of Data Fiduciaries, purposes of processing children's personal data and related conditions under section 9(4);
  11. other matters forming part of the Data Protection Impact Assessment process under section 10(2)(c)(i);
  12. other measures to be undertaken by a Significant Data Fiduciary under section 10(2)(c)(iii);
  13. the manner in which a Data Principal may request information under section 11(1);
  14. the manner in which a Data Principal may request erasure under section 12(3);
  15. the period within which a Data Fiduciary must respond to grievances under section 13(2);
  16. the manner of nomination by a Data Principal under section 14(1);
  17. standards for processing personal data for the exemption under section 17(2)(b);
  18. the manner of appointment of the Chairperson and other Members of the Board under section 19(2);
  19. salary, allowances and other service conditions of the Chairperson and Members under section 20(1);
  20. authentication of orders, directions and instruments under section 23(1);
  21. terms and conditions of appointment and service of officers and employees of the Board under section 24;
  22. techno-legal measures to be adopted by the Board under section 28(1);
  23. other matters under section 28(7)(d);
  24. the form, manner and fee for filing an appeal under section 29(2);
  25. the procedure for dealing with an appeal under section 29(8); and
  26. any other matter that is required or permitted to be prescribed or provided for by rules.

Digital Personal Data Protection Rules, 2025

The rule-making power under Section 40 has been exercised through the Digital Personal Data Protection Rules, 2025. The Rules provide implementation details for several provisions of the DPDP Act, including notice requirements, Consent Managers, reasonable security safeguards, personal data breach intimation, retention and erasure, verifiable parental consent, rights of Data Principals, Significant Data Fiduciaries and the functioning of the Data Protection Board.

For compliance purposes, Section 40 should therefore be read together with the relevant substantive section of the DPDP Act, the corresponding provision of the DPDP Rules, 2025, and the applicable commencement provisions. A rule cannot override or be inconsistent with the parent Act.

Why Section 40 is important

The DPDP Act establishes the principal rights, duties, powers and safeguards, while Section 40 enables detailed implementation through delegated legislation. This structure permits procedural and technical requirements to be specified by rules without repeatedly amending the primary Act.

Practical point: When reading any DPDP Act provision that uses expressions such as "as may be prescribed", "in such manner as may be prescribed" or "within such period as may be prescribed", check the DPDP Rules, 2025 and the applicable commencement notification for the operative detail.

Related provisions

Section 39 - Bar of jurisdiction precedes the rule-making provision. Section 41 - Laying of rules and certain notifications deals with placing rules and specified notifications before Parliament.

This page is intended for legal information and should be read with the official text of the Act, Rules and commencement notifications applicable on the relevant date.