44 sections across 9 chapters — 35 explained so far, in plain language, each one cross-linked back to the exact sub-clause it covers. The rest are being finished and reviewed.
Two sub-sections, and the second one is the reason "is the DPDP Act in force?" doesn't have a single yes-or-no answer — different provisions switch on at different times.
Twenty-eight defined terms, and almost every one of them gets reused verbatim in every other section of the Act — get one wrong here and the misreading follows you through the whole statute.
One section, four clauses, and it decides a question every other section assumes has already been answered: does the DPDP Act even reach this data in the first place.
Two sub-sections that open Chapter II, and they collapse every possible justification for processing personal data down to exactly two: consent, or a legitimate use. There's no third door.
Three sub-sections, and together they answer a question Section 6's consent language assumes is already settled: informed about what, exactly, and told when.
Ten sub-sections defining what actually counts as consent under this Act — and most consent flows built before anyone read this section closely fail at least one of the five tests it sets.
Nine specific situations, and nothing outside them — Section 7 is a closed list, not a general "legitimate interest" basis an organisation can stretch to fit whatever processing it wants to justify.
Eleven sub-sections, and together they're the operational backbone of the Act — everything a Data Fiduciary actually has to do once it has a lawful basis to process data at all.
Five sub-sections stacked on top of Section 8's baseline — one about consent, one about harm that no consent can override, one flat ban, and two narrow exemption gateways.
A status the government hands out, not one you self-assess your way into — and once it lands, three extra obligations attach on top of everything Section 8 already requires.
Three things a Data Principal can demand to see, and one thing conspicuously absent from the list — a right to take that data anywhere else.
Once a correction or erasure request lands, action is mandatory unless the Act or another law actually blocks it — "we'll review your request" isn't a lawful third option.
The Data Protection Board isn't a Data Principal's first stop — this section makes an organisation's own grievance mechanism a statutory filter she has to go through first.
The shortest section in Chapter III, and a narrow one — it lets rights survive death or incapacity, but "incapacity" here means something specific, not a general stand-in for the account owner.
The Act doesn't only place obligations on organisations. Five duties bind the Data Principal too, and they exist to keep the rights regime from becoming cover for fraud, not to burden ordinary requests.
Explainers for this chapter are being finalised and reviewed — check back soon.
Three short sub-sections that do one job — bring the Data Protection Board of India into legal existence, give it a body corporate's powers, and leave its start date and address to be fixed later by notification.
Two sub-sections covering how the Board's Chairperson and Members are paid, and how long they hold office — a short section, but one that shapes how independent the Board can actually be in practice.
Three sub-sections covering how someone leaves the Board voluntarily, how the seat gets refilled once any vacancy opens, and what they can't do for a year after they've gone.
Three sub-sections that keep the Board's day-to-day functioning from grinding to a halt over a technicality — how it conducts meetings, why minor defects don't invalidate what it's already decided, and who steps in when the Chairperson can't act.
A single sentence that decides how the Board builds out its staff — and ties every hire back to the Central Government's approval, not just the Board's own judgment of what it needs.
One sentence that pulls everyone acting for the Board — Chairperson, Members, officers, and employees alike — under the Indian Penal Code's public-servant provisions, whenever they're acting under this Act.
The closing section of Chapter V, and the one that decides how work actually gets distributed across the Board — three specific powers that belong to the Chairperson alone, not to the Board as a collective.
Five distinct routes put a matter in front of the Data Protection Board, and every one of them ends the same way — an inquiry, and the power to fine.
Twelve sub-sections that take a complaint from intake to a decision — an inquiry run digitally by design, borrowing a civil court's evidence powers but stopping well short of a raid.
Two sub-sections, and together they mean a Tribunal order never needs a fresh civil suit to enforce it — it already carries a civil court's decree-execution power built in.
One sentence gives the Board an off-ramp from a full inquiry — mediation, but only when the Board thinks it fits, never as a mandatory first step.
A person facing a Board proceeding can offer to fix the problem itself, and have the Board accept that in place of pursuing a formal finding — with no requirement that the outcome is ever made public.
One inquiry, one finding of a significant breach, and the Board can reach for the Schedule — where a single failure to secure personal data properly is capped at ₹250 crore, the steepest number anywhere in the Act.
One sentence, and it settles a question people keep assuming has a different answer: a Data Principal who complains and wins doesn't get paid — the Government does.
This section protects the people running the Act, not the people the Act regulates — a distinction that's easy to misread on a first pass.
Two monetary penalties on the same Data Fiduciary is the threshold — cross it, and the sanction available next isn't a bigger fine, it's public access to your service getting blocked.
The DPDPA doesn't clear the field of every other regulator you already answer to — it stacks on top, and only wins outright where something genuinely conflicts.
If it's a matter the Board is empowered to decide, a civil court simply isn't the venue — and it can't step in to injunct the Board's own actions either.
Every DPDP Rule that exists today traces back to one of the twenty-six lettered items in this section — it's the Act's own table of contents for what it deliberately left to delegated legislation.
The Schedule's ₹250 crore ceiling isn't frozen forever — but it isn't infinitely adjustable by notification either. There's a hard cap on how far the Government can push it without going back to Parliament for a full amendment.
30 minutes with us usually gets further than another hour searching the Act text on your own.
Book a Consultation