Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter IX — Miscellaneous
DPDP Act, 2023 · Chapter IX of IX

Chapter IX: Miscellaneous

Chapter IX gathers the Act's supporting provisions: protection for good-faith action, information and direction powers of the Central Government, how the Act fits with other laws, rule-making, and the amendments it makes to other statutes.

Sections 35–44 · 10 sectionsPhased: 3 in force, 7 effective 13 May 2027Reviewed September 2026
Back to the Full DPDP Act Guide
  1. 35Protection of Action Taken in Good Faith
  2. 36Power to Call for Information
  3. 37Power of Central Government to Issue Directions
  4. 38Consistency with Other Laws
  5. 39Bar of Jurisdiction
  6. 40Power to Make Rules
  7. 41Laying of Rules and Certain Notifications
  8. 42Power to Amend Schedule
  9. 43Power to Remove Difficulties
  10. 44Amendments to Certain Acts

Chapter summary

In plain terms: This chapter includes good-faith protection (Section 35), the Central Government's power to call for information (Section 36) and to issue directions (Section 37), the Act's relationship with other laws (Section 38), the bar on civil-court jurisdiction (Section 39), rule-making and Parliamentary oversight (Sections 40–41), the power to amend the Schedule (Section 42), the power to remove difficulties (Section 43) and amendments to the TRAI Act, the Information Technology Act and the Right to Information Act (Section 44).

How the sections fit together

Chapter IX bundles the supporting provisions. Sections 35 to 39 deal with protection for action in good faith, the Central Government's information and direction powers, how the Act sits with other laws, and the bar on civil courts. Sections 40 to 43 are the delegated-power sections: making rules, laying them before Parliament, amending the Schedule and removing difficulties. Section 44 amends three other statutes.

Read it in two halves: the first set tells you who can do what and which forum decides disputes, the second tells you how the law can change after enactment.

Sections at a glance

Sections 35–44 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 35Protection of Action Taken in Good FaithEffective 13 May 2027

Section 35 shields the Central Government, the Board and its people from legal proceedings over anything they did, or intended to do, in good faith under the Act or its rules.

Read the full explanation Sec. 36Power to Call for InformationEffective 13 May 2027

Section 36 gives the Central Government a broad, standing power to demand information from the Board and from any Data Fiduciary or intermediary, for the Act's purposes.

Read the full explanation Sec. 37Power of Central Government to Issue DirectionsEffective 13 May 2027

Section 37 is the Act's most consequential public-interest power: after a Board reference showing repeated penalties against a Data Fiduciary, the Central Government can, after hearing that Fiduciary, order any intermediary to block public access to the information tied to its goods or services.

Read the full explanation Sec. 38Consistency with Other LawsEffective 13 May 2027

Section 38 answers a question that comes up constantly in practice: what happens when the DPDP Act and some other Indian law seem to say different things?

Read the full explanation Sec. 39Bar of JurisdictionEffective 13 May 2027

Section 39 keeps civil courts out of matters the Board is specifically empowered to handle under the Act, and stops courts from granting injunctions over action taken or to be taken under the Act.

Read the full explanation Sec. 40Power to Make RulesIn force

Section 40 is the legal source of the entire DPDP Rules, 2025 — the power letting the Central Government fill in the operational detail the Act itself leaves to be "prescribed," across 26 specific listed matters.

Read the full explanation Sec. 41Laying of Rules and Certain NotificationsIn force

Section 41 gives Parliament a check on the Central Government's rule-making and notification powers — every rule and certain notifications must be laid before both Houses, which can modify or annul them within a 30-day window.

Read the full explanation Sec. 42Power to Amend ScheduleEffective 13 May 2027

Section 42 lets the Central Government update the Act's penalty Schedule by notification rather than needing a fresh Act of Parliament — but caps how far penalties can be increased, at double the amount originally enacted.

Read the full explanation Sec. 43Power to Remove DifficultiesEffective 13 May 2027

Section 43 is a standard safety-valve clause: if putting the Act into effect runs into a genuine difficulty, the Central Government can issue an order to fix it — but only within five years of commencement, and always subject to Parliament seeing the order afterward.

Read the full explanation Sec. 44Amendments to Certain ActsIn force

Section 44 closes out the Act with three consequential amendments to existing laws — the Telecom Regulatory Authority of India Act, the Information Technology Act, and the Right to Information Act — needed to make the rest of the Act's machinery actually fit into India's existing legal framework.

Read the full explanation

Key terms in this chapter

Good faith
Honest action taken without intent to cause harm. Section 35 protects such action by the Government, the Board and their officers.
Delegated legislation
Rules and notifications made under powers the Act gives the Central Government.
Laying before Parliament
The requirement in Section 41 that rules and certain notifications be placed before both Houses, which can modify or annul them.
Power to remove difficulties
A limited power to issue orders to resolve difficulties in giving effect to the Act, exercisable for a fixed period.
Consequential amendment
A change made to another law, such as the IT Act or the RTI Act, so that it fits the new framework.

Why this chapter matters

Several of these sections have practical consequences: Section 38 makes the Act operate in addition to other laws, Section 39 keeps data protection disputes with the Board rather than civil courts, Section 40 is the source of the DPDP Rules, and Section 44 changes the IT Act and the RTI Act in ways that affect existing compliance programmes.

Who needs to care about this chapter

  • Legal teams mapping how the DPDP Act interacts with the IT Act, the RTI Act and sector regulations.
  • Policy and public-affairs teams tracking rule-making and delegated powers.
  • Public authorities that handle both RTI requests and personal data.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • Track rules and notifications issued under Section 40, since they set operational detail.
  • Check how the DPDP Act interacts with sector rules that apply to you.
  • Review how Section 44's changes to the IT Act and RTI Act affect existing policies.
  • If you handle RTI requests, review personal data exemptions in the amended RTI provision.
  • Plan for the possibility that the Schedule or penalties are amended by notification.

Common mistakes to avoid

  • Assuming the DPDP Act repeals other applicable laws.
  • Ignoring delegated legislation. A large share of operational detail is in the Rules and notifications.
  • Planning to take a data dispute to a civil court when the Act bars civil jurisdiction on matters the Board decides.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 23 — Calling for Information

Read the Rule

Rule 1 — Short Title and Commencement

Read the Rule

Common questions

Does the DPDP Act replace other data protection laws?
No. Section 38 says the Act is in addition to, and not in derogation of, other laws, though it prevails where there is a conflict about the same subject matter. Sector rules can continue to apply.
Can a civil court hear DPDP disputes?
Section 39 bars civil courts from entertaining suits or proceedings on matters the Board is empowered to decide under the Act, and from granting injunctions about them.
What changes does the Act make to other laws?
Section 44 amends the Telecom Regulatory Authority of India Act, the Information Technology Act and the Right to Information Act so that they fit with the new framework.
Who can make rules under the Act?
The Central Government, under Section 40. The DPDP Rules, 2025 were made under that power and are explained rule by rule on this site.
What happens if the DPDP Act conflicts with another law?
Section 38 says the Act is in addition to other laws, and that it prevails to the extent of any conflict about the same matter.
What does Section 44 change?
It amends the Telecom Regulatory Authority of India Act, the Information Technology Act and the Right to Information Act so they fit with the new data protection framework.
Does this section mean the Board can never be sued for anything?
No - the protection only covers action done or intended in good faith under the Act's provisions; it doesn't provide blanket immunity for conduct outside that good-faith standard.
Are individual Board officers personally protected, or only the Board as an institution?
Both - the section names the Central Government, the Board, its Chairperson, and any Member, officer or employee individually.
Is this the same as the Board's power to gather evidence during an inquiry?
No - Section 28(7) gives the Board specific civil-court-equivalent evidence-gathering powers tied to a particular inquiry. Section 36 is a separate, general power belonging to the Central Government, not tied to any specific ongoing proceeding.
Can the Central Government request information from the Board itself?
Yes - this section specifically includes the Board among the entities the Central Government can require to furnish information.
Can the government block a company's platform after just one penalty from the Board?
No - sub-section (1)(a) specifically requires the Data Fiduciary to have been penalised in two or more instances before this power's threshold is met, alongside the Board's own written reference advising blocking is in the public interest.
Does the affected Data Fiduciary get a chance to respond before a blocking order is made?
Yes - sub-section (1) requires the Central Government to give the Data Fiduciary an opportunity of being heard before issuing any such order.
Does the DPDP Act override all other Indian laws about data?
No - sub-section (1) makes clear the Act generally applies in addition to other law, not instead of it. The override in sub-section (2) only applies where there's an actual, unavoidable conflict between specific provisions.
If our sector-specific law and the DPDP Act both address the same topic, does that automatically count as a conflict?
Not necessarily - if both laws can be complied with simultaneously (even if they cover overlapping ground), that generally isn't the kind of "conflict" sub-section (2) is addressing; a true conflict is where compliance with one would require violating the other.
Can we sue in a regular civil court instead of appealing to the Appellate Tribunal?
No, not for a matter within the Board's empowered jurisdiction - Section 39 bars civil courts from entertaining such matters; the Section 29 appeal to the Appellate Tribunal is the correct route.
Can we get a court to pause a Board inquiry while we pursue other legal options?
Section 39 specifically bars courts and other authorities from granting an injunction over action taken or to be taken under the Act's powers, which would generally rule out this kind of interim relief.
Why does the Act keep saying "as may be prescribed" instead of just stating the requirement directly?
Because Section 40 specifically delegates that operational detail to rules the Central Government makes separately - the DPDP Rules, 2025 - rather than fixing every mechanical detail in the Act's own text.
Can the government just issue new rules without any public process?
Sub-section (1) requires rule-making to be subject to the condition of previous publication, which generally means an opportunity for public awareness before finalisation - consistent with the DPDP Rules' own public consultation process in January 2025 ahead of their November 2025 notification.
Does Parliament have to approve DPDP Rules before they take effect?
No - rules take effect on notification, but they're laid before Parliament afterward, giving both Houses a window to agree on modifying or annulling them within the process this section describes.
If a rule is later modified by Parliament, does that undo compliance actions already taken under the original rule?
No - the closing proviso specifically preserves the validity of anything previously done under the rule or notification before any modification or annulment.
Can the government raise DPDP penalties as much as it wants through this power?
No - sub-section (1) caps any increase at double the amount originally specified in the Schedule when the Act was enacted in 2023; going beyond that would require a fresh Act of Parliament.
Does a notified Schedule amendment need separate legislation to take effect?
No - sub-section (2) gives a properly notified amendment the same effect as if it had been enacted directly in the Act, from the date of notification.
Can the government keep using this power indefinitely to adjust the Act?
No - sub-section (2) specifically prohibits making any order under this section after the expiry of three years from the Act's commencement.
Does an order under this section need to go through the same modification process as rules under Section 41?
Sub-section (3) requires every such order to be laid before both Houses of Parliament, similar in spirit to Section 41's requirement, though this section's own text doesn't spell out the same explicit 30-day modification and annulment mechanism.
Is Section 43A of the IT Act still in effect for data-protection compensation claims?
No - Section 44(2)(a) of the DPDP Act omits Section 43A from the Information Technology Act, 2000, reflecting that the DPDP Act's own framework now governs this area.
Did the Right to Information Act's personal-information exemption change because of the DPDP Act?
Yes - Section 44(3) substitutes a new clause in RTI Act Section 8(1)(j) specifically addressing the personal-information exemption, aligned with the DPDP Act's framework.

Related pages

Chapter VIII — Penalties and Adjudication

The previous chapter of the Act.

Read Chapter VIII

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

DPDP Rules, 2025

The rules made under Section 40.

Read the Rules

DPDP Updates

Latest notifications and commencement dates.

See the updates