BACK TO DPDP ACT
DPDP Act 2023

Section 38

Power of Central Government to Make Rules

THE STATUTE

Original Text

(1) The Central Government may, by notification, make rules for carrying out the provisions of this Act. (2) In particular, and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely — (a) the manner of giving notice under section 5; (b) the conditions subject to which the Data Principal may exercise her rights under section 11, 12, 13 and 14; (c) the technical, operational, financial and other conditions for registration of Consent Managers; (d) the composition of the Board under section 18; (e) the manner of appointment, qualifications, terms of office, salary, allowances and conditions of service of the Chairperson and Members; (f) the duties, powers and conditions of service of officers and employees; (g) the form and manner of complaint, the procedure for inquiry by the Board and such timelines as may be required; (h) the manner of implementing voluntary undertaking; (i) the manner of preferred appeal to the High Court; (j) the form and period for which the annual statement of accounts shall be prepared; (k) measures to be undertaken by Significant Data Fiduciaries; (l) such other matters as are to be or may be prescribed.

Simplified

Section 38 is the engine room of DPDP Act implementation — it is the primary rule-making power under which the Central Government will notify the DPDP Rules that operationalise virtually every substantive provision of the Act. The DPDP Act is a framework statute: it establishes rights, obligations, and institutional structures, but leaves the operational details — timelines, formats, procedures, conditions, and technical specifications — to subordinate legislation. Without the DPDP Rules, most of the Act's provisions cannot be practically implemented. The subjects on which rules may be made under Section 38(2) include: notice manner (how Section 5 notices must be given); conditions for exercising Data Principal rights (access, correction, erasure, nomination); Consent Manager registration conditions; Board composition; Chairperson and Member appointment procedures, qualifications, salary, and terms; Board staff conditions; complaint form, inquiry procedure, and timelines; voluntary undertaking implementation; High Court appeal procedure; annual accounts form; Significant Data Fiduciary measures; and any other prescribed matters. The 'without prejudice to generality' clause means rules can be made on any matter necessary to carry out the Act, not just the listed subjects. The DPDP Rules have been under development since the Act's enactment in August 2023 — a public consultation draft was released in 2024. Until the Rules are notified, many of the Act's provisions remain incompletely operationalised. The Rules, when notified, will be the practical compliance reference for the majority of DPDP obligations.

Common Queries

As of 2024–25, the DPDP Rules are in development. The Central Government released a public consultation draft in 2024. The Rules are expected to be notified in tranches, consistent with the phased commencement approach of the Act.
The DPDP Act is a framework statute — it establishes the structure but leaves operational details to DPDP Rules made under Section 38. The 'as may be prescribed' formulation means those details will be in the Rules, not the statute itself.
Yes. Rules made under Section 38 must be laid before both Houses of Parliament under Section 39, which can pass resolutions to modify or annul them. This provides legislative oversight of the executive's rule-making.

Legal Context

The DPDP Act was deliberately enacted as a framework statute, with extensive rule-making delegation, to allow flexibility in implementation without requiring Parliamentary amendment for every operational detail. This approach has precedent in Indian law (GST, Companies Act, etc.) but has also drawn criticism — the extensive delegation means that Parliament approved a framework, and the actual compliance obligations are determined by executive rule-making.

Key Rules & Provisions

Comprehensive rule-making power — virtually every operational aspect of the Act depends on Rules.

DPDP Rules under development — compliance obligations will crystallise upon Rules notification.

Parliamentary laying requirement for Rules — oversight of the most important subordinate legislation.

General power 'without prejudice to generality' — Rules not limited to listed subjects.

Related Case Laws

Delhi Laws Act In Re (1951)

AIR 1951 SC 332
RELEVANCE

The Supreme Court's landmark ruling on the limits of legislative delegation — Parliament cannot delegate essential legislative functions. The extensive rule-making delegation in Section 38 must stay within this constitutional boundary: the Act must contain sufficient guidelines (the intelligible differentia test), which the DPDP Act's detailed substantive framework provides.