(1) The Central Government may, by notification in the Official Gazette, make rules to carry out the purposes of this Act. (2) Without prejudice to the generality of the foregoing, such rules may provide for— (a) the manner of obtaining consent; (b) the notice requirements; (c) the processing of children's personal data; (d) the security safeguards; (e) the registration and obligations of Consent Managers; (f) the rights of Data Principals and the procedure for exercising them; (g) the penalties and the procedure for imposing them; (h) such other matters as the Central Government considers necessary.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 40 is the delegated legislation provision — it lists 26 specific items that can be governed by Rules without requiring a Parliamentary amendment to the Act itself. The DPDP Rules 2025 are made under this power. Because the operational detail of much of the Act is in the Rules rather than the Act itself, the Central Government has significant flexibility to update operational requirements without returning to Parliament. This also means the compliance landscape can evolve more rapidly than a purely statute-based framework would allow.