Digital Personal Data Protection Act 2023 with Rules Bare Act with Section Notes

Digital Personal Data Protection Act 2023 with Rules [Bare Act with Section Notes] by Taxmann is a single-volume working Edition of the Act and its Rules. The statutory text is freely available; what this book supplies is the apparatus around it—Section Notes under seven sections; the Digital Personal Data Protection Rules 2025, with their seven Schedules and five footnotes on the corrections of 10th December 2025; the Digital Personal Data Protection (Removal of Difficulties) Order 2026, with its two substitutions carried into the text of the Act; the three notifications of 13th November 2025 on commencement and the Board; a four-page Contents list; and a Subject Index to the Act of fifty-four heads and twenty-one sub-entries.

The book solves a practical problem. Anyone working under the Act has to piece together four things:

• The Act, with the two substitutions made by the Removal of Difficulties Order 2026
• The Rules of 2025, with the corrections notified on 10th December 2025
• The notifications that fix when the provisions of the Act take effect and set up the Board
• Explanations of the Act's purpose and definitions, of notice and consent, and of how it relates to section 43A of the Information Technology Act 2000

This volume brings them together: it prints Section Notes under seven sections of the Act, the Rules after the Act, and the Order and the notifications after the Rules.

This book is intended for the following audience:

• Data Protection Officers and Privacy Teams who draft notices, consent requests and breach procedures, with note 5.1 on the notice, notes 6.1 to 6.6 on consent and its withdrawal, and rules 3, 6 and 7
• Businesses and Startups that Process Personal Data who must work out their duties as Data Fiduciaries, with the penalty notes that tie sections 4 to 7 to item 7 of the Schedule, the exemption notes on sections 4, 6, 7 and 9, and the erasure periods in the Third Schedule
• Lawyers and In-house Counsel who advise on consent, legitimate uses, exemptions and penalties, with notes 6.9 to 6.11 on section 7 and the text of section 17, section 33 and the Schedule of penalties
• Consent Managers who seek registration with the Board, with rule 4 and the conditions and obligations in Parts A and B of the First Schedule
• Government Departments and Public Bodies who process personal data to provide subsidies, benefits, certificates and licences, with rule 5, the standards in the Second Schedule and note 2.6, which shows how 'person' takes in the State
• Schools, Hospitals and Platforms Used by Children who need verifiable parental consent, with notes 9.1 and 9.2, rules 10 and 12, the four illustrations under rule 10 and the Fourth Schedule
• IT and Information Security Teams who put safeguards and breach reporting in place, with rule 6 on security safeguards, rule 7 on intimation to the Board within seventy-two hours and rule 8(3) on keeping logs for one year
• Chartered Accountants and Company Secretaries who advise boards on the move from section 43A of the Information Technology Act 2000, with notes 1.8 to 1.12 on the protection under section 43A and the Rules of 2011, and on what the Act adds
• Law Students and Researchers who study privacy law, with the eighteen question-and-answer notes under section 1 and notes 2.1 to 2.6-1 on the definitions, several of them drawing on the report of the Expert Committee chaired by Justice B.N. Srikrishna

The Present Publication is the 2027 Edition, covering the text of the Digital Personal Data Protection Act 2023 [Act No. 22 of 2023], and the Digital Personal Data Protection Rules 2025, with the law stated as updated till 20th September 2026. It has the following noteworthy features:

• [Section Notes – The Core Editorial Feature] Section Notes are printed under seven sections—fifty-one numbered notes and three sub-notes such as 2.3-1. The eighteen notes under section 1 are framed as questions and answers: what the Act is about, when it takes effect, the seven principles it rests on, the report of the Expert Committee chaired by Justice B.N. Srikrishna, the protection under section 43A of the Information Technology Act 2000 and the Rules of 2011 made under it, and the rights, obligations, exemptions and Board functions the Act sets up. Notes 2.1 to 2.6-1 take up 'data', 'digital personal data', 'personal data', 'Data Principal', 'child' and 'Data Fiduciary', and why the Act uses 'Data Principal' and 'Data Fiduciary' in place of 'data subject' and 'data controller'. Notes 3.1 to 3.3 cover the reach of the Act, notes 4.1 and 5.1 the grounds for processing and the notice, and notes 6.1 to 6.6 consent, its withdrawal and Consent Managers. Notes 6.9 to 6.11 take up the legitimate uses in section 7, and penalty notes tie sections 4 to 7 to item 7 of the Schedule
• [Digital Personal Data Protection Rules 2025] The Rules, notified by G.S.R. 846(E) of 13th November 2025, are printed after the Act—twenty-three rules and seven Schedules, from the conditions and obligations of Consent Managers to the erasure periods for large e-commerce, online gaming and social media platforms and the terms of service of the Board's Chairperson, Members, officers and employees. The illustrations under rules 8 and 10 and in the First Schedule are printed with them, and five footnotes mark the corrections made by G.S.R. 892(E) of 10th December 2025
• [Removal of Difficulties Order 2026] The Digital Personal Data Protection (Removal of Difficulties) Order 2026, S.O. 5458(E), is printed after the Rules. The two substitutions it makes—'of' before 'a person with disability' in section 9(1), and 'data audit' for 'audit' in section 10(2)(c)(ii)—are carried into the text of the Act, and two footnotes record them
• [Commencement Notifications] An Appendix prints the three notifications of 13th November 2025: G.S.R. 843(E), which appoints the dates on which the provisions of the Act take effect, in three stages; G.S.R. 844(E), which establishes the Data Protection Board of India with its head office in the National Capital Region; and G.S.R. 845(E), which fixes the Board at four members. An asterisk note under section 1(2) points to the Appendix
• [Research Tools] A four-page Contents list sets out the sections of the Act by Chapter, the rules and Schedules, the Order and the Appendix, with page references. A Subject Index to the Act of fifty-four heads and twenty-one sub-entries gives section references, and running heads carry section and rule references
• [Authoritative Bare Act Presentation] Taxmann's Bare Act editorial format is followed throughout. Section and rule headings are set in bold, and a boxed COMMENTS device under seven sections keeps the Section Notes apart from the statutory text

The structure of the book is as follows:

• Contents
• Digital Personal Data Protection Act 2023, with Section Notes
  • Chapter I: Preliminary (sections 1 to 3)
  • Chapter II: Obligations of Data Fiduciary (sections 4 to 10)
  • Chapter III: Rights and Duties of Data Principal (sections 11 to 15)
  • Chapter IV: Special Provisions (sections 16 and 17)
  • Chapter V: Data Protection Board of India (sections 18 to 26)
  • Chapter VI: Powers, Functions and Procedure to be Followed by Board (sections 27 and 28)
  • Chapter VII: Appeal and Alternate Dispute Resolution (sections 29 to 32)
  • Chapter VIII: Penalties and Adjudication (sections 33 and 34)
  • Chapter IX: Miscellaneous (sections 35 to 44)
  • Schedule: penalties
• Subject Index
• Digital Personal Data Protection Rules 2025
  • Rules 1 to 23
  • First to Seventh Schedules
• Digital Personal Data Protection (Removal of Difficulties) Order 2026
• Appendix: Notifications