Chapter IX · Miscellaneous
Section 40: Power to Make Rules
Section 40 is the engine room of the DPDP regime: it gives the Central Government power to make the Rules that fill in the operational detail the Act itself leaves open.
- Chapter
- Chapter IX · Miscellaneous
- Status
- In force
- Effective
- 13 November 2025
- Applies to
- The Central Government
- Official citation
- DPDP Act, 2023, s.40
- Reading time
- 4 min
- Updated
- August 2026
At a glance
Section 40 empowers the Central Government to make rules, by notification, to carry out the provisions of the Act [40(1)], and lists the specific matters on which rules may be made [40(2)]. These rule-making heads cover much of the operational detail the Act leaves open, including the manner of giving notice and consent, the functioning of Consent Managers, obligations of Significant Data Fiduciaries, the exercise of Data Principal rights, the appointment and procedure of the Board, and more. Because so much of the practical compliance detail lives in the Rules rather than the Act, Section 40 is where the working rulebook comes from. It is already in force, having commenced on 13 November 2025, and the DPDP Rules, 2025 are made under it.
Key takeaways
- Section 40 gives the Central Government power to make the DPDP Rules by notification [40(1)].
- It lists specific rule-making heads [40(2)], covering notice, consent, Consent Managers, Significant Data Fiduciary duties, rights processes, Board procedure and more.
- Much of the real compliance detail lives in the Rules, not the Act, so this section is where the working rulebook comes from.
- It is already in force (since 13 November 2025), which is why the DPDP Rules, 2025 could be made.
- Watch the Rules, not just the Act: operational requirements can change as rules are notified and updated under this power.
Who should read this
Read this if you want to know why the Act alone does not tell you exactly how to comply: the how lives in the Rules, and Section 40 is the power that creates them.
In plain language
Section 40 is a delegation of power. Parliament wrote the Act at the level of principles and duties, and left the operational detail to be filled in by Rules that the Central Government notifies under this section.
That is why, in practice, you have to read the Act and the DPDP Rules, 2025 together. The Act tells you what your obligations are; the Rules, made under Section 40, tell you the specifics of how to meet them, and those specifics can evolve as new rules are notified.
The text of the law
Section 40: Power to Make Rules
40(1) The Central Government may, by notification, make rules to carry out the provisions of the Act.
40(2) Such rules may provide for the specified matters, including the manner of notice and consent, the functioning of Consent Managers, the obligations of Significant Data Fiduciaries, the exercise of Data Principal rights, and the appointment, procedure and functioning of the Board.
Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Track the DPDP Rules, 2025 and any amendments as closely as the Act itself: your concrete obligations (formats, timelines, thresholds) are set there under this power.
- Build a monitoring habit: because rules are notified and can be updated under Section 40, treat rule changes as a standing compliance input, not a one-time read.
- When you design controls, map each to its source (Act section or Rule) so that if a rule changes, you know exactly which control to revisit. Want a current, mapped view of your obligations? Take the readiness assessment or find a specialist.
Frequently asked questions
What does Section 40 do?
Are the DPDP Rules, 2025 made under this section?
Why do we need the Rules if we have the Act?
Is Section 40 in force?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.