Section 40 — Power to make rules

What this section requires

The Central Government can make rules, not inconsistent with the Act and subject to prior publication, to carry out its purposes — and Section 40(2) lists the specific matters those rules may cover, from notice content and Consent Manager registration through breach-notification format, children's-data exemptions, SDF measures, Data Principal request procedures, Board appointment and procedure, and appeal filing. The Digital Personal Data Protection Rules, 2025 are exactly this rule-making power exercised.

Who it applies to

The Central Government, in its rule-making capacity — this section is the statutory source of the Rules this guide cites throughout, not an independent Data Fiduciary duty.

Checklist

• Not applicable — a rule-making power carries no fiduciary-facing checklist of its own; its output (the Rules) is what carries the actual compliance detail cited throughout this guide.

Penalty exposure

Not applicable — this section grants a rule-making power; it creates no obligation the Schedule penalises.

Implementation timeline

In force since 13 November 2025.