Section 40 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Many of the Act's practical details are left "as may be prescribed". Section 40 is the source of that power: the Central Government may, by notification and subject to previous publication, make rules not inconsistent with the Act. Sub-section (2) lists the matters in clauses (a) to (z). The DPDP Rules, 2025 (notified November 2025) now carry the detail, and this article uses the Act's own list as a map of where to look in them. For help with compliance built on the Rules, see our legal consultation service.
Section 40(1): the Central Government may, by notification and subject to previous publication, make rules not inconsistent with the Act to carry out its purposes. Section 40(2): without limiting that power, rules may provide for the matters in clauses (a) to (z), which include notice, Consent Manager registration, breach intimation, verifiable consent, response periods, Board appointments and appeal procedure. Every rule must be laid before Parliament under section 41. This article does not state any rule number, period or form from the Rules.
The limits of the power
- By notification, after previous publication. The draft must be published before the rule is made.
- Not inconsistent with the Act. A rule cannot contradict the Act or go beyond its purposes. The Act sets the ceiling.
- "To carry out the purposes of this Act". The general power.
- "In particular and without prejudice to the generality". The list in section 40(2) is illustrative, and clause (z) catches "any other matter which is to be or may be prescribed".
- Parliamentary control. Section 41 requires every rule to be laid for thirty days, and Parliament may modify it or agree it should not be made. See sections 41 to 43.
The matters listed in section 40(2), mapped to the Act
| Clause | Matter | Provision it serves | Article in this series |
|---|---|---|---|
| (a) | Manner of informing the Data Principal in the notice | s.5(1) | Section 5 notice |
| (b) | Manner of informing under the notice for earlier consent | s.5(2) | Section 5(2) |
| (c) | Accountability and obligations of Consent Manager | s.6(8) | Consent Manager |
| (d) | Registration of Consent Manager and conditions | s.6(9) | Consent Manager |
| (e) | Subsidy, benefit, service, certificate, licence or permit for legitimate use | s.7(b) | Section 7 |
| (f) | Form and manner of breach intimation to the Board | s.8(6) | Breach intimation |
| (g) | Time period for the specified purpose to be deemed no longer served | s.8(8) | Erasure |
| (h) | Manner of publishing the Data Protection Officer's business contact information | s.8(9) | Contact information |
| (i) | Manner of obtaining verifiable consent | s.9(1) | Parental consent |
| (j) | Classes of Data Fiduciaries, purposes and conditions for children's data exemption | s.9(4) | Children exemptions |
| (k) | Other matters of the Data Protection Impact Assessment | s.10(2)(c)(i) | SDF duties |
| (l) | Other measures of the Significant Data Fiduciary | s.10(2)(c)(iii) | SDF duties |
| (m) | Manner of request for information | s.11(1) | Right to access |
| (n) | Manner of request for erasure | s.12(3) | Correction and erasure |
| (o) | Period within which grievances must be answered | s.13(2) | Grievance |
| (p) | Manner of nomination | s.14(1) | Right to nominate |
| (q) | Standards for research, archiving, statistics exemption | s.17(2)(b) | Section 17(2) |
| (r) | Manner of appointment of Chairperson and Members | s.19(2) | Sections 19 to 21 |
| (s) | Salary, allowances and terms of Chairperson and Members | s.20(1) | Sections 19 to 21 |
| (t) | Manner of authentication of Board orders, directions and instruments | s.23(1) | Sections 22 to 26 |
| (u) | Terms of appointment and service of Board officers and employees | s.24 | Sections 22 to 26 |
| (v) | Techno-legal measures of the Board | s.28(1) | Section 28 |
| (w) | Other civil-court-type matters | s.28(7)(d) | Section 28(7)-(12) |
| (x) | Form, manner and fee of appeal | s.29(2) | Section 29 |
| (y) | Procedure for dealing with an appeal | s.29(8) | Section 29(6)-(10) |
| (z) | Any other matter to be or which may be prescribed | Any | - |
What this list tells you
- Deadlines live in the Rules. The Act gives no period for responding to a grievance (clause (o)) or for deeming a specified purpose no longer served (clause (g)), and does not give the form of breach intimation (clause (f)). Compliance calendars must be built from the Rules.
- Some protective detail is in the Rules. How verifiable consent is obtained (clause (i)) and which classes of fiduciaries get which children's exemptions (clause (j)) are prescribed matters.
- Procedure before the Board and the Tribunal is prescribed, so the practical path for complaints and appeals is found there (clauses (t) to (y)).
- The Schedule is not in the list. Penalty amounts are in the Schedule and can be changed only under section 42, not by rules.
- Not every "as may be prescribed" is in the list. Clause (z) covers the rest, for example the "other information" that a Data Principal may obtain under section 11(1)(c).
How to work with the Rules
- Read the Act first, then the Rules. The Rules prescribe only what the Act allows; a rule beyond the Act is open to challenge as inconsistent with section 40(1).
- Check commencement. The Rules were notified in November 2025 with different provisions commencing on different dates; confirm what is in force before relying on a rule.
- Do not copy figures from summaries. Take periods, forms and thresholds from the official text of the Rules.
- Keep a rule register mapping each obligation to its source: Act section and rule.
- Watch for amendments. The power in section 40 can be used again.
Example
A company builds its grievance process. Section 13(2) says it must respond within "such period as may be prescribed". The Act gives no number; clause (o) of section 40(2) places it in the Rules. The company reads the Rules for the period, records the rule in its register and builds the response timer from that source.
What section 40 does not say
- It does not set a time by which the Rules must be made.
- It does not say what happens to rules if the Act is amended.
- It does not limit the Rules to the listed matters.
- It does not address sector regulators' rules.
Need help reading the Act and the Rules together?
Turning "as may be prescribed" into a compliance calendar needs both documents open side by side. Our legal consultation team can help you build a rule-by-rule register and align your processes to it.
Key takeaways
- The Central Government makes rules by notification after previous publication, consistent with the Act.
- Section 40(2) lists matters (a) to (z), with clause (z) as a catch-all.
- Periods, forms and procedures left "as may be prescribed" are found in the Rules.
- Penalty amounts are not set by rules; only section 42 can amend the Schedule.
- Rules are laid before Parliament for thirty days (section 41).
Read next
- Sections 41, 42 and 43: laying of rules, Schedule amendment and removal of difficulties
- Section 1 of the DPDP Act, 2023: short title and commencement
- DPDP Rules 2025: draft rules and key provisions
- DPDP Act compliance checklist for businesses
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.