Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter IX · Miscellaneous

Section 36: Power to Call for Information

Section 36 gives the Central Government a broad information-gathering power: it can require the Board, or any Data Fiduciary or intermediary, to furnish such information as it may call for.

Official text
Section 36Power to call for info
Chapter
Chapter IX · Miscellaneous
Status
Enacted · phased commencement
Full compliance
13 May 2027
Applies to
DF, intermediaries, Board
Official citation
DPDP Act, 2023, s.36
Reading time
3 min
Updated
August 2026

At a glance

Section 36 empowers the Central Government, for the purposes of the Act, to require the Data Protection Board and any Data Fiduciary or intermediary to furnish such information as it may call for. It is a broad, standalone information-requisition power sitting alongside, and separate from, the Board's own inquiry powers under Section 28. The Act does not itself narrow the categories of information or set a procedure, and the details are expected to be shaped by the Rules and practice. Section 36 takes effect on 13 May 2027.

Applies to DF, intermediaries, BoardChapter Chapter IXEffective 13 May 2027Read time 3 min

Section 36: key takeaways

  • Section 36 lets the Central Government call for information from the Board, any Data Fiduciary or any intermediary, for the purposes of the Act.
  • It is a broad power: the Act does not spell out the categories of information or a fixed procedure.
  • It is separate from a Board inquiry under Section 28: a request under Section 36 is not itself a penalty proceeding.
  • For a Data Fiduciary, it means government information requests are part of the regime, so keeping orderly, retrievable records matters.

Who Section 36 applies to

Read this if you are a Data Fiduciary or intermediary: it is the clause that lets the Central Government ask you directly for information, over and above anything the Board may seek in an inquiry.

FoundersLegal / DPOCompliance leadsProduct / engineering

Section 36 in plain language

Section 36 is short and broad. It gives the Central Government a direct power to call for information from the Board, from any Data Fiduciary, or from any intermediary, for the purposes of the Act.

The Act does not, in this section, list what can be asked for or how. That detail is left to be shaped by the Rules and practice. Practically, the takeaway for a business is simple: be able to find and produce your records when a lawful request lands, without scrambling.

Section 36 of the DPDP Act: full text

Section 36: Power to Call for Information

36 The Central Government may, for the purposes of the Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What Section 36 means for your business

  • Keep your data and compliance records retrievable: a data inventory, processing records, consent and notice logs, and breach documentation should be findable on short notice.
  • Route any government information request through legal and privacy immediately, so responses are accurate, consistent and scoped to what is actually asked.
  • Do not confuse a Section 36 request with a Board inquiry: responding to one does not resolve or trigger the other, and your penalty position is governed separately. Want to check your records would stand up? Take the readiness assessment or find a specialist.

Frequently asked questions about Section 36

Who can call for information under Section 36?
The Central Government, for the purposes of the Act. It can require information from the Board, any Data Fiduciary or any intermediary.
Is a Section 36 request the same as a Board inquiry?
No. It is a standalone information-gathering power, separate from the Board's Section 28 inquiry process.
What information can be asked for?
The Act does not limit the categories in this section; the scope is broad and further detail is expected through the Rules and practice.
Does responding create a penalty?
Not by itself. Section 36 is about furnishing information; penalties are decided separately under Section 33 after an inquiry.

Sources

Related sections
Section 35: Protection of Action in Good FaithSection 28: Procedure Followed by BoardData Protection Board (glossary)Chapter IX overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment