Lesson 1.2: Anatomy of the Act and the Rules

Module 1 · Lesson 1.2 of 8 · About 25 minutes · Anatomy of the Act and

Know the shape of the law so you can find any rule quickly. The Act sets the principles; the Rules explain how to comply. This DPDPA 2023 course page explains anatomy of the act and in plain language.

anatomy of the act and - DPDPA 2023 course lesson banner

What you will learn about anatomy of the act and

Describe how the Act, the Rules and the Schedules fit together
Find where each major topic sits
Read a section reference with confidence

Act, Rules and Schedules (anatomy of the act and)

The Act has 44 sections and one Schedule. The Schedule lists the penalty amounts. The Rules, made by the Central Government, supply the practical detail: the form of the notice, security safeguards, breach reporting, timelines, and the working of the Board. The Rules, 2025 contain 23 rules and several Schedules. Always read the Act and the Rules together.

Where to find what

Topic	Act	Rules, 2025
Applicability and scope	Section 3	Rule 1 and 2
Notice	Section 5	Rule 3
Consent and legitimate uses	Sections 6 and 7	Rule 3 and 4 (Consent Managers)
General duties, security, breach, erasure	Section 8	Rules 6, 7 and 8
Children and persons with disability	Section 9	Rules 10 to 12
Significant Data Fiduciaries	Section 10	Rule 13
Rights of Data Principals	Sections 11 to 14	Rule 14 and 15
Cross-border transfer	Section 16	Rule 15
Exemptions	Section 17	Rule 5, 16 and Schedules
Penalties	Section 33 and Schedule	Rules 17 to 21 (Board)

Rule numbers above are a study aid. Confirm against the official Rules text, as numbering is easy to mix up.

Click through the structure (anatomy of the act and)

Tap or click a step to see exactly what to do.

How to read a legal provision

Find the actor: who must do something (Data Fiduciary, Processor, Data Principal)?
Find the verb: shall, may, must not.
Find the trigger: when does the duty start?
Find the exception: look for the words unless, except and subject to.

Activity (5 minutes) (anatomy of the act and)

Open the official Act in another tab and locate Section 8. Read sub-section 5 and write one sentence on what it asks a company to do.

Tip: Keep a one-page cheat sheet of section numbers. You will refer to it constantly.

Check your understanding of anatomy of the act and

Q1. How many sections does the DPDP Act, 2023 have?

Q2. Where are penalty amounts listed?

Q3. Who makes the Rules?

← Why India needs a data protection law Who and what the law covers →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for anatomy of the act and: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.