Every DPDP Rule that exists today traces back to one of the twenty-six lettered items in this section — it's the Act's own table of contents for what it deliberately left to delegated legislation.
40. (1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.
(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—
(a) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5;
(b) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5;
(c) the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6;
(d) the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6;
(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7;
(f) the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8;
(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;
(h) the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8;
(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;
(j) the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9;
(k) the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;
(l) the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;
(m) the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11;
(n) the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12;
(o) the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13;
(p) the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14;
(q) the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17;
(r) the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19;
(s) the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20;
(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;
(u) the terms and conditions of appointment and service of officers and employees of the Board under section 24;
(v) the techno-legal measures to be adopted by the Board under sub-section (1) of section 28;
(w) the other matters under clause (d) of sub-section (7) of section 28;
(x) the form, manner and fee for filing an appeal under sub-section (2) of section 29;
(y) the procedure for dealing an appeal under sub-section (8) of section 29;
(z) any other matter which is to be or may be prescribed or in respect of which provision is to be, or may be, made by rules.
Section 40(1) gives the Central Government the power to make rules by notification, subject to the condition of previous publication, so long as those rules aren't inconsistent with the Act and are made to carry out its purposes. That's a fairly standard delegated-legislation formula. What makes Section 40 worth reading closely is 40(2) — a list of twenty-six specific matters, lettered (a) through (z), that Parliament flagged in advance as things the Rules would need to fill in.
Rather than reproduce all twenty-six items, it's more useful to see how directly they map onto the DPDP Rules, 2025 that actually followed: the manner of notice to a Data Principal under Sections 5(1) and 5(2) (items a-b); Consent Manager accountability and registration under Sections 6(8) and 6(9) (items c-d); the form and manner of breach intimation to the Board under Section 8(6) (item f) — the exact clause behind Rule 7's two-step notification process; the manner of obtaining verifiable consent under Section 9(1) and the classes of Fiduciary permitted to process a child's data under Section 9(4) (items i-j); the further Data Protection Impact Assessment and Significant Data Fiduciary measures under Section 10(2)(c) (items k-l); how a Data Principal makes an access or erasure request under Sections 11(1) and 12(3) (items m-n); the timeline for responding to grievances under Section 13(2) (item o); and, at the end, a residual clause under item (z) for "any other matter which is to be or may be prescribed" — the catch-all that keeps the list from being read as exhaustive.
When a specific Rule feels unusually detailed or narrow, tracing it back to its lettered item in Section 40(2) usually explains why — the Act itself pre-authorised exactly that level of specificity for that exact sub-section, rather than the Rules inventing new obligations wholesale. It's also a useful check on scope: a Rule that doesn't map back to anything in this list, or to the Act's general purpose under 40(1), would be open to challenge as exceeding the rule-making power it was supposedly made under.
Section 41 is the parliamentary check that sits on top of every rule made under this section — laying it before both Houses, with a window to modify or annul it. Section 8's breach-notification duty (item f) is the clearest example of a Section 40(2) item that's already fully fleshed out — Rule 7's actual two-step process is what item (f) authorised the Government to write.
30 minutes to walk through your specific compliance questions — no obligation.
Book a Consultation