Sansa Law Desk

Winning an appeal is not the same as being paid. Section 30 of the Digital Personal Data Protection Act, 2023 is the provision that turns a Tribunal order into something enforceable, and the choice it offers is the part worth planning. To execute an Appellate Tribunal order there are two routes, and they are not interchangeable. Step 1: Fix the Commencement Position Section 30 belongs to the group that comes into force eighteen months after publication of commencement notific

Section 31 carries the heading alternate dispute resolution, which promises more than the section delivers. A direction to mediate is the only mechanism it provides, the Board decides whether to give one, and the section is silent on almost everything that happens next. Those silences are the practical content of the provision. Step 1: Fix the Commencement Position Section 31 belongs to the group that comes into force eighteen months after publication of commencement notifica

Section 25 of the Digital Personal Data Protection Act, 2023 is one sentence long, it is in force, and it does its work by pointing at a provision of a statute that no longer exists. The public servant deeming is therefore a provision that cannot be read on its own face. It has to be read with the repeal that overtook it. Step 1: Note That This One Is Operative Under commencement notification G.S.R. 843(E) dated November 13, 2025, sections 18 to 26 came into force on publicat

When an undertaking changes hands under a sanctioned scheme, the personal data in it moves too, and nobody asks the data principals first. The Act provides for that, but more narrowly than the deal documents usually assume. The scheme and merger exemption in clause (e) of section 17(1) attaches to an approved scheme rather than to a transaction, and it leaves two obligations standing. Step 1: Fix the Commencement Position Section 17 belongs to the group that comes into force

Most DPDP advice to employers starts with consent, which is the wrong starting point for an employment relationship. The Act provides a separate ground, and the employment legitimate use in clause (i) of section 7 carries a different set of consequences from consent: no notice obligation, and, on the text, no access or correction right running against the employer. The savings are real and so are the traps. Step 1: Fix the Commencement Position Section 7 belongs to the group

Almost every account of the Digital Personal Data Protection Act, 2023 is written about obligations that commence in 2027. Two sections are already operating, and they are the two that bear on a court's power to hear anything at all. The bar of jurisdiction in section 39 and the consistency rule in section 38 both came into force on publication of the commencement notification, which puts them in force while the obligations they sit behind are not. Step 1: Fix the Commencemen

Most DPDP advice stops at the ceiling in the Schedule. The number that will actually be imposed is governed by seven matters listed in section 33(2), and an organisation that builds its record against those matters is doing the only useful mitigation work available. The mitigation case is assembled years before it is deployed. Step 1: Fix the Commencement Position Section 33 is in the group that comes into force eighteen months after publication of the commencement notificati

The Digital Personal Data Protection Act, 2023 is usually described as adding obligations. It also takes a remedy away. Section 44(2)(a) omits section 43A of the Information Technology Act, 2000, which is the provision under which a person affected by a data breach has been able to claim compensation from the body corporate that held the data. The replacement regime penalises, but it does not compensate. Step 1: Fix the Commencement Position Section 44(2) is in the group that

Nearly every account of the Digital Personal Data Protection Act, 2023 is written about duties that commence in 2027. One change is operating now. An RTI request for personal information falls to be decided under a clause that section 44(3) rewrote, and the rewrite removed the test that public information officers had been applying for twenty years. Step 1: Fix What Is in Force, Because This Part Is Under the commencement notification G.S.R. 843(E) dated November 13, 2025, se

Almost every account of the Digital Personal Data Protection Act, 2023 is written from the fiduciary's side. Section 15 runs the other way. The duties under section 15 bind the data principal herself, and a breach of them carries the one penalty in the Act aimed at an individual rather than at an organisation. A complaint is therefore not a costless act, and the advice given before one is filed should say so. Step 1: Fix the Commencement Position Section 15 sits within sectio

The sanction practitioners overlook in the Digital Personal Data Protection Act, 2023 is not the penalty. It is the blocking direction under section 37, by which the Central Government may direct that public access to a data fiduciary's offering in India be blocked. It is not a first response to a breach. It is a consequence of a penalty record, which is what makes it a governance problem rather than a litigation one. Step 1: Fix the Commencement Position Section 37 comes int

A voluntary undertaking is the only route in the Digital Personal Data Protection Act, 2023 by which a person under inquiry can close the matter on terms it has helped write. Section 32 lets the Data Protection Board accept one at any stage of a proceeding, and acceptance bars further proceedings on what the undertaking covers. Section 31 offers a different off ramp, mediation, which is the Board's to direct rather than the party's to elect. Step 1: Fix the Commencement Posit

The received account of Indian cross border data law is that section 16 of the Digital Personal Data Protection Act, 2023 permits transfer anywhere except to a country the Central Government restricts. That is accurate as far as it goes, and it is not the whole provision set. Rule 15 of the Digital Personal Data Protection Rules, 2025 adds a second and quite different control where a data fiduciary seeks to transfer personal data outside India, one that turns on who receives

Most of the Digital Personal Data Protection Rules, 2025 point at the data principal. Rule 23 points the other way. It authorises a Central Government demand for information addressed to a data fiduciary or an intermediary, for purposes set out in the Seventh Schedule, and in defined circumstances it lets the government forbid the recipient from telling anyone that the demand was answered. A compliance programme built only around consent and rights requests has nothing in it

Every remedy the Digital Personal Data Protection Act, 2023 gives a data principal runs through one body, so the composition and appointment of the Data Protection Board is not an administrative footnote. Sections 18 to 20 of the Act and rules 17 and 18 of the Digital Personal Data Protection Rules, 2025 are the machinery, and unlike most of the framework they are in force. Reading them closely is how an adviser works out what the Board is, who staffs it, and what has to happ