DPDP Act 2023
Draft DPDP Rules 2025
Final DPDP Rules 2025
Ministry of Law and Justice

Chapter 1 – Preliminary (DPDP Act 2023)

Chapter 2 – Obligations of Data Fiduciary

Chapter 3 – Rights and Duties of Data Principal

Chapter 4 – Special Provisions

Chapter 5 – Data Protection Board of India

Chapter 6 – Powers & Procedures of the Board

Chapter 7 – Appeals & Alternate Dispute Resolution

Chapter 8 – Penalties & Adjudication

Chapter 9 – Miscellaneous

Schedule – DPDP Act 2023

Rule 1 – DPDP Draft Rule 1

Rule 2 – DPDP Draft Rule 2

Rule 3 – DPDP Draft Rule 3

Rule 4 – DPDP Draft Rule 4

Rule 5 – DPDP Draft Rule 5

Rule 6 – DPDP Draft Rule 6

Rule 7 – DPDP Draft Rule 7

Rule 8 – DPDP Draft Rule 8

Rule 9 – DPDP Draft Rule 9

Rule 10 – DPDP Draft Rule 10

Rule 11 – DPDP Draft Rule 11

Rule 12 – DPDP Draft Rule 12

Rule 13 – DPDP Draft Rule 13

Rule 14 – DPDP Draft Rule 14

Rule 15 – DPDP Draft Rule 15

Rule 16 – DPDP Draft Rule 16

Rule 17 – DPDP Draft Rule 17

Rule 18 – DPDP Draft Rule 18

Rule 19 – DPDP Draft Rule 19

Rule 20 – DPDP Draft Rule 20

Rule 21 – DPDP Draft Rule 21

Rule 22 – DPDP Draft Rule 22

Conditions for Registration of Consent Manager

Schedule Second – DPDP Draft Rules

Schedule Third – DPDP Draft Rules

Schedule Fourth – DPDP Draft Rules

Schedule Fifth – DPDP Draft Rules

Schedule Sixth – DPDP Draft Rules

Schedule Seventh – DPDP Draft Rules

DPDP Final Rule 1

DPDP Final Rule 2

DPDP Final Rule 3

DPDP Final Rule 4

DPDP Final Rule 5

DPDP Final Rule 6

DPDP Final Rule 7

DPDP Final Rule 8

DPDP Final Rule 9

DPDP Final Rule 10

DPDP Final Rule 11

DPDP Final Rule 12

DPDP Final Rule 13

DPDP Final Rule 14

DPDP Final Rule 15

DPDP Final Rule 16

DPDP Final Rule 17

DPDP Final Rule 18

DPDP Final Rule 19

DPDP Final Rule 20

DPDP Final Rule 21

DPDP Final Rule 22

DPDP Final Rule 23

First Schedule – DPDP Final Rules

Second Schedule – DPDP Final Rules

Third Schedule – DPDP Final Rules

Fourth Schedule – DPDP Final Rules

Fifth Schedule – DPDP Final Rules

Sixth Schedule – DPDP Final Rules

Seventh Schedule – DPDP Final Rules

Home Final DPDP Rules SECOND SCHEDULE [See rules 5(1) and 16]

SECOND SCHEDULE

SECOND SCHEDULE [See rules 5(1) and 16]

Standards for processing of personal data by State and its instrumentalities under clause (b) of section 7 and for processing of personal data necessary for the purposes specified in clause (b) of subsection (2) of section 17

Implementation of appropriate technical and organisational measures to ensure effective observance of the following, in accordance with applicable law, for the processing of personal data, namely: —

  • (a) Processing is carried out in a lawful manner;
  • Processing is done for the uses specified in clause (b) of section 7 of the Act or for the purposes specified in clause (b) of sub-section (2) of section 17 of the Act, as the case may be;
  • (c) Processing is limited to such personal data as is necessary for such uses or achieving such purposes, as the case may be;
  • (d) Processing is done while making reasonable efforts to ensure the completeness, accuracy and consistency of personal data;
  • (e) Personal data is retained till required for such uses or achieving such purposes, as the case may be, or for compliance with any law for the time being in force;
  • (f) Reasonable security safeguards to prevent personal data breach to protect personal data in the possession or under control of the Data Fiduciary, including in respect of any processing undertaken by it or on its behalf by a Data Processor;
  • (g) Where processing is to be done under clause (b) of section 7 of the Act, the same is undertaken while giving the Data Principal an intimation in respect of the same and—
    • (i) giving the business contact information of a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data;
    • (ii) specifying the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any, using which such Data Principal may exercise her rights under the Act; and
    • (iii)is carried on in a manner consistent with such other standards as may be applicable to the processing of such personal data under policy issued by the Central Government or any law for the time being in force; and
  • (h) Accountability of the person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, for effective observance of these standards.

Prev Next