Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsFree Excel worksheet
An Excel worksheet that makes your data map ready for the day something goes wrong. For each system it records what data is held, roughly how many people, how to reach them, where the logs are, how to contain and recover, and who to call out of hours. It is built to sit beside our guide to data mapping for breach readiness.
Free XLSX, about 27 KB. Link appears on the next page.
It suits security and IT leads, privacy and compliance owners, and operations managers who would be pulled into an incident call. It works best beside a personal data inventory and a processor register, because it uses the same activity IDs and processor IDs.
It helps you scope an incident. It does not decide whether an event is a breach, draft a report or tell you how to notify the Board or Data Principals. The file will hold out-of-hours contact details, so limit who can open it and record categories of data and rough counts, not personal data.
No. It helps you scope an incident: which systems, which data, how many people, how to reach them and which processors are involved. It does not tell you how to notify the Board or Data Principals, or what the deadlines are. Our reporting guide covers that.
Section 8(5), Section 8(6), Rule 6 and Rule 7 commence on 13 May 2027. Section 8(6) and Rule 7 require the Data Fiduciary to intimate the Board and each affected Data Principal.
No. It is your own measure of how long a rehearsal takes when you use only the worksheet to list the systems, data, people and processors involved.
It will contain contact details for people who must be reachable out of hours. Record categories of data and rough counts, not personal data, and share the file only with those who need it.
Yes. It costs nothing. You enter your name, work email, organisation and role (phone is optional) and tick the consent box. The next page gives you a download link that works for one hour. If it expires, submit the form again.
We use them to send you the worksheet and to contact you about it. We send DPDP updates only if you tick the second box. You can withdraw your consent at any time by writing to hi@dpdpactindia.in. The Privacy Policy has the detail.
Consultant-led and partner-backed.