Section 40: Power to Make Rules

Quick summary

What Section 40 says

• Sub-section (1) — the Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the Act's provisions, to carry out the purposes of the Act.
• Sub-section (2) — in particular, and without prejudice to the generality of that power, such rules may provide for the following matters:
• Section 5(1) and (2) — the manner of notice.
• Section 6(8) — the manner of Consent Manager accountability and obligations.
• Section 6(9) — registration conditions for Consent Managers.
• Section 7(b) — the subsidy, benefit, service, licence and permit categories.
• Section 8(6) — the form and manner of breach intimation.
• Section 8(8) — the time period for a specified purpose to be deemed no longer served.
• Section 8(9) — the manner of publishing Data Protection Officer contact information.
• Section 9(1) — the manner of obtaining verifiable consent.
• Section 9(4) — classes of Data Fiduciaries and conditions for processing children's data.
• Section 10(2)(c)(i) — Data Protection Impact Assessment matters.
• Section 10(2)(c)(iii) — other Significant Data Fiduciary measures.
• Section 11(1) — the manner of a Data Principal's access request.
• Section 12(3) — the manner of an erasure request.
• Section 13(2) — the period for responding to grievances.
• Section 14(1) — the manner of nomination.
• Section 17(2)(b) — processing standards for the research, archiving and statistical exemption.
• Section 19(2) — the manner of Board Chairperson and Member appointment.
• Section 20(1) — their salary and service terms.
• Section 23(1) — the manner of authenticating Board orders.
• Section 24 — Board officer and employee terms.
• Section 28(1) — techno-legal measures.
• Section 28(7)(d) — other matters relating to the Board's civil-court-equivalent powers.
• Section 29(2) — the form, manner and fee for appeals.
• Section 29(8) — the procedure for appeals.
• Catch-all — any other matter which is to be, or may be, prescribed, or in respect of which provision is to be made by rules.

Breaking it down

This section is why the DPDP Act reads, in many places, as a framework rather than a complete operational manual — almost every specific mechanism (what a notice must contain in practice, how a Consent Manager actually registers, what breach-intimation forms look like) is deliberately left to be “prescribed,” and Section 40 is the power that lets the government actually prescribe it.

Rule-making isn't unchecked — it comes with a procedural safeguard. Sub-section (1)'s “subject to the condition of previous publication” requirement means proposed rules generally have to be published before being finalised, giving an opportunity for public awareness (and, historically, the DPDP Rules themselves went through a public consultation process before final notification in November 2025).

The list in sub-section (2) is essentially a map of every “as may be prescribed” reference elsewhere in the Act. Reading through this list is a useful way to see, at a glance, exactly which operational details across the whole Act are governed by the Rules rather than the Act's own text — and each cross-reference points to the specific section whose detail the Rules fill in.

This power necessarily had to be in force before the Rules themselves could be notified. Since Section 40 is what authorises rule-making at all, it (along with Section 41's laying requirement) had to be operative before the DPDP Rules, 2025 could be validly issued — consistent with this section's status as in force since 13 November 2025, alongside the rest of Chapter I and the Board-establishment chapter.

Why this section matters

Understanding Section 40 explains the entire relationship between the Act and the DPDP Rules covered elsewhere on this site: the Act sets out rights, obligations and structure at a principled level, while Section 40 is the specific delegation of authority that lets the operational mechanics be filled in separately, and updated over time without needing a fresh Act of Parliament each time a procedural detail needs adjusting.

Real-world example

Who needs to care about this section

• Anyone trying to understand why a specific compliance detail lives in the Rules rather than the Act — Section 40 is the reason, and its list shows exactly which topics were delegated this way.
• Policy and government-affairs teams — tracking future rule amendments matters, since Section 40 means operational requirements can change without a fresh Act of Parliament.

Common questions

Related sections