Skip to main content
Reading the DPDP Act and Rules Together | Aizzentec — page loaded
Phase 3 enforcement: 13 May 2027. The runway is now.Speak to Aizzentec +91 8220 359 506
Compliance

Reading the DPDP Act & Rules together: a practitioner's guide

The Act gives you the duties; the Rules give you the operational detail. Here's how to read them in tandem.

Compliance14 min read
By Praveen Kumar, Practice Leader — Risk, Cyber and AnalyticsCA, CISA, CEH, CDPSE, CFEPublished Updated

Why most teams misread the Act

The DPDP Act, 2023 is a duty-based statute. It tells you what a Data Fiduciary must do — give notice, take consent, secure data, respond to rights, report breaches. The Rules notified on 13 November 2025 tell you how to do those things, and to what standard.

Reading the Act alone gives you the right principles but the wrong granularity. Reading the Rules alone gives you mechanical detail without the principles that make those mechanics defensible.

The pairings that matter most

Here are the seven Section-Rule pairings every practitioner should be able to recite from memory:

1. Section 5 (notice) ↔ Rule 3 (notice content)

Section 5 says you must give notice. Rule 3 specifies the form and minimum content: itemised list of personal data, itemised list of purposes, the link to withdraw consent, the link to exercise rights, the route to the Data Protection Board. Without Rule 3, your notice may be 'compliant' but useless. With both, it actually works.

2. Section 6 (consent) ↔ Rule 4 (Consent Manager registration)

Section 6 sets the consent standard — free, specific, informed, unconditional, unambiguous. Rule 4 governs how Consent Managers (a new ecosystem of intermediaries) get registered with the DPBI. If your business model intersects with consent infrastructure — and many fintech, AA-related, or cross-platform businesses do — Rule 4 matters.

3. Section 8(5)-(6) (security & breach) ↔ Rules 6 and 7

The Act says you must take reasonable security measures and notify the Board (and affected Data Principals) of personal data breaches. Rule 6 specifies the seven safeguard categories — encryption, access control, logging, etc. Rule 7 specifies breach-notification format and timing. Together they form your security-and-breach baseline.

4. Section 9 (children) ↔ Rule 10 (verifiable parental consent)

Section 9 prohibits processing of children's data without verifiable parental consent and prohibits tracking, behavioural monitoring or targeted advertising of children. Rule 10 specifies what 'verifiable' means in practice — and the answer is: not a self-declared age gate. This pairing is the single most operationally demanding obligation in the entire framework for consumer-facing services.

5. Section 10 (SDF) ↔ Rules 12 and 13

Section 10 lets the Central Government designate Significant Data Fiduciaries based on volume, sensitivity, sectoral exposure, and other criteria. Rules 12-13 specify the additional obligations: DPIAs, annual independent audit, India-based DPO with board-reporting, periodic risk assessment. If you might qualify, start preparing now — you don't get a transition period after notification.

6. Sections 11-14 (rights) ↔ Rules 14 and 15

The Act creates four rights for Data Principals: access, correction, erasure, grievance redressal. Rule 14 sets the 90-day SLA for response. Rule 15 governs the appeal route to the Data Protection Board. Without operational tooling — a DSAR portal, identity verification, system mapping — meeting the SLA at any meaningful volume is impossible.

7. Section 16 (cross-border) ↔ Rule 13(4) for SDFs

Section 16 currently permits cross-border transfer except where the Central Government issues a country-restriction notification. Rule 13(4) gives the Government additional latitude to require certain personal data of SDFs to remain within India. The default is open; the future is conditional. Map your flows now.

The reading order that works

If you're new to the framework, read in this order:

  1. Sections 4-9 of the Act (the substantive duties)
  2. Rules 3, 6, 7, 10, 14 (the operational detail for those duties)
  3. Section 10 of the Act + Rules 12-13 (SDF readiness)
  4. Sections 27-28 of the Act (the Data Protection Board)
  5. The Schedule of Penalties (the price of getting it wrong)
Practitioner tip
Build a single side-by-side reference document for your team that maps each Section to its Rule(s), with your organisation's specific control or process noted in a third column. We've found this single artefact does more to align legal, engineering and operations than any number of training sessions.

What's still being phased in

Phase 1 is now: notice, consent, security, breach reporting and rights frameworks should already be operational. Phase 2 — expected around November 2026 — brings the Consent Manager ecosystem live. Phase 3, on 13 May 2027, brings the substantive obligations including SDF triggers, the full grievance and audit machinery, and the formal start of penalty enforcement.

Read the law together. Build the operations together. Don't wait for Phase 3.

All knowledge articles

Related articles