Video Library

DPDP Act video shorts — 208 explainers, mapped to the Act

208 short, section-by-section video explainers of India's DPDP Act, scripted in English with a Hindi dub for each. Every card below links to the dpdpact.info guide page for that exact section.

1 of 208 are live on YouTube right now. The rest are uploading in daily batches (4-6/day, YouTube's own quota ceiling) — check back, or re-run this page's build script after each batch.

208 of 208 shown

Section 6(1)

Your Contact List Isn't Necessary

Consent is capped at the data necessary for the specified purpose — the Act's own telemedicine illustration

Section 15

The Fine That Applies To You

The duties of a Data Principal carry their own penalty: ₹250 crore for the company, ₹10,000 for you

Section 13(2)

Ninety Days

The rights clock, corrected: ninety days is the grievance cap, and the s.11 sharing list is the right almost nobody uses

Section 2(f)

Eighteen, Not Thirteen

Under-18 is a child here, and tracking, behavioural monitoring and targeted advertising at children are prohibited outright

Section 2(j)

You Are The Data Principal

The Act names *you*, and for a child or a person with disability the name includes the parent or guardian

Section 2(i)

The One Who Decides

The test is purpose and means, never possession — and “alone or in conjunction with other persons” means two deciders are two Data Fiduciaries.

Section 2(k)

One Name Is On The Hook

The Processor works for the Fiduciary; the Fiduciary stays responsible for it no matter what the contract says

Section 2(t)

Your Name Is Not The Test

"any data about an individual who is identifiable by or in relation to such data" — wider than a name

Section 3(a)

Paper Is Not An Escape Hatch

The Act covers digital personal data, and paper that is digitised later

Section 2(x)

Deleting Is Processing

The enacted list runs from collection to destruction and is only illustrative — “includes operations such as” — so storage and erasure are both processing.

Section 2(u)

A Breach Isn't Only A Hack

Accidental disclosure, loss of access, alteration — availability counts, so ransomware and a deleted backup are both breaches

Section 2(y)

The Act Calls Everyone "She"

s.2(y) makes "she" gender-neutral throughout the statute — a drafting choice worth one video

Section 2(s)

The State Is A Person Here

"person" includes an individual, HUF, company, firm, AoP, the State, and every artificial juristic person

Section 2(za)

The Purpose Is What They Wrote

The purpose is whatever the notice stated — so the notice is the boundary of what they may do

Section 2(o)

Why The Act Defines "Gain"

The Act defines *gain* and *loss* — they set the Board's penalty calculus later

Section 2(g)

One Place To Withdraw It All

A registered single point to give, manage, review and withdraw consent

Section 3(a)

Collected In India

Applies to digital personal data processed in India, collected digitally or digitised later

Section 3(b)

Offering Goods To India Is Enough

Processing outside India is covered if it relates to offering goods or services to people in India

Section 3(c)(i)

Your Family Group Chat Is Not Covered

Personal or domestic purpose is outside the Act

Section 3(c)(ii)(A)

You Published It Yourself

Data the Data Principal made public is outside the Act — the Act's own blogging illustration

Section 3(c)(ii)(B)

Published Because The Law Says So

Data someone else is legally obliged to publish is also outside

Section 4(1)

Two Grounds. That's All.

Consent, or "certain legitimate uses". There is no third door — no "legitimate interest" balancing test

Section 4(2)

Lawful Means Not Forbidden

"Lawful purpose" is defined negatively: any purpose not expressly forbidden by law

Section 38

The Act Beats The Other Law

On conflict, this Act prevails to the extent of the conflict — but it is *in addition to*, not in derogation of, other laws

Section 39

No Civil Court Will Hear It

Civil courts are barred where the Board is empowered; no injunctions either

Section 13(2)

Ninety Days Or Nothing? Not Quite

The corrective video — 90 days is the *grievance* cap (r.14(3)); rights requests have no statutory clock

Section 5(1)

The Notice Comes First

Every consent request must be accompanied or preceded by a notice

Rule 3(b)(i)

Itemised

The notice must carry an itemised description of the personal data

Rule 3(b)(ii)

And What You Actually Get

It must describe the specific goods, services or uses the processing enables — not just "to improve services"

Rule 3(a)

It Must Stand On Its Own

The notice has to be understandable independently of anything else on the page

Rule 3(c)

Three Links They Owe You

Withdraw consent · exercise rights · complain to the Board — as an actual link, in the notice

Section 5(3)

In Your Language

Notice and consent request must be available in English or any Eighth Schedule language

Section 5(2)

Consent Before The Act? Still Owed A Notice

Pre-commencement consent survives, but they must send you the notice "as soon as reasonably practicable"

Section 6(1)

Five Words That Define Consent

Free, specific, informed, unconditional, unambiguous — with a clear affirmative action

Section 6(1)

A Pre-Ticked Box Is Not An Action

"Clear affirmative action" kills the pre-ticked box and the scroll-is-consent pattern

Section 6(1)

Capped At What The Purpose Needs

Consent is limited to the data necessary for the specified purpose — the Act’s own telemedicine contact-list illustration.

Section 6(2)

Invalid To The Extent

An unlawful part of a consent is invalid only to that extent; the rest of the consent survives.

Section 6(4)

As Easy To Leave As To Join

Withdrawal must be comparable in ease to giving — the Act and the Rules both say it

Section 6(5)

Withdrawing Has A Price, And That's Legal

You bear the consequences; processing before withdrawal stays lawful — the shopping-order illustration

Section 6(6)

They Must Stop, And Make Their Processor Stop

After withdrawal the Fiduciary must cease and cause its Processors to cease — the telecom-billing illustration

Section 6(10)

They Have To Prove You Said Yes

In a proceeding the burden is on the Fiduciary to prove notice and consent

Section 7(a)

You Handed It Over Yourself

Data voluntarily provided for a purpose, with no objection indicated, needs no separate consent — the pharmacy receipt illustration

Section 7(a)

And You Can Switch It Off

The broker illustration: once you say you no longer need help, processing must stop

Section 7(b)

Subsidies And Benefits

The State may process for a subsidy, benefit, service, certificate, licence or permit where you consented before, or where it already holds the data in a notified database.

Section 7(b)

The Maternity-Benefit Example

The Act's own illustration of eligibility-checking for another benefit

Rule 5(2)

What "Using Public Funds" Means

Consolidated Fund, public account, or a local authority's funds — the Rules define the phrase

Second Schedule

The Standards The State Still Owes

Second Schedule: lawful, purpose-limited, minimal, accurate, retention-limited, secured, accountable — plus an intimation to you and a contact person

Section 7(c)

Functions Of The State

Performance of a legal function, or sovereignty, integrity and security of the State

Section 7(d)

When A Law Makes Them Disclose

Compliance with a statutory disclosure obligation is a legitimate use

Section 7(e)

Court Orders

Judgments and decrees in India, and foreign civil/contractual orders

Section 7(f)

Medical Emergency

A threat to life or immediate threat to health — yours or anyone's

Section 7(g)

Epidemic And Disaster

Public-health measures, and safety during a disaster or breakdown of public order (disaster = Disaster Management Act, 2005 s.2(d))

Section 7(i)

Your Employer's Lane

Employment purposes, and safeguarding the employer from loss or liability — espionage, trade secrets, IP, classified information

Section 8(1)

The Contract Cannot Save Them

Responsibility holds irrespective of any agreement to the contrary and even if *you* broke your duties

Section 8(2)

No Processor Without A Contract

A Processor may only be engaged under a valid contract

Section 8(3)

Accurate If It Decides About You

Completeness, accuracy and consistency are mandatory where the data will drive a decision about you or be shared onward

Section 8(4)

Measures, Not Intentions

Appropriate technical and organisational measures for effective observance

Section 8(5)

The ₹250 Crore Duty

Reasonable security safeguards — the single most expensive obligation in the Act

Rule 6(1)(a)

Encrypt, Mask, Tokenise

The Rules' minimum list starts with encryption, obfuscation, masking or virtual tokens

Rule 6(1)(c)

Who Looked At Your File

Logs, monitoring and review, so unauthorised access can be detected, investigated and stopped from recurring

Rule 6(1)(e)

Keep The Logs A Year

One-year retention of logs and data for detection and investigation

Rule 6(1)(d)

Backups Are A Legal Duty

Reasonable measures for continued processing if confidentiality, integrity or availability is compromised

Rule 6(1)(f)

It Has To Be In The Contract

The Processor contract must carry the safeguards clause

Section 8(9)

A Human Who Answers

Publish the DPO's or a responsible person's business contact — and repeat it in every reply to a rights request

Section 8(10)

A Grievance Mechanism That Works

An *effective* mechanism is the obligation; "effective" is the operative word

Rule 7(2)(b)

Seventy-Two Hours

72 hours is the Board's deadline; your own intimation is "without delay" with no number

Rule 7(1)(a)

Five Things The Email Must Say

Description · consequences for you · mitigation · what you should do · a human contact

Rule 7(1)

"We Take Security Seriously" Is Not Notice

Measured against r.7(1)'s five items, the standard PR breach email fails four of them

Rule 7(2)(a)

What The Board Gets First

Without delay: nature, extent, timing, location, likely impact

Rule 7(2)(b)(i)

And What It Gets In 72 Hours

Six items including findings on who caused it and a report on what victims were told

Rule 7(2)(b)

The Extension Must Be Asked For

The 72 hours extends only on a written request the Board allows

Section 8(6)

Telling You Late Costs ₹200 Crore

Schedule item 2 — failing to notify the Board or you

Rule 7(1)

Your Account Is The Delivery Address

Intimation goes through your user account or a channel you registered — so a dead email address is their problem, not a defence

Section 2(u)

Losing Access Is A Breach Too

Ransomware, a wiped backup, an expired key: availability is in the definition

Section 27(1)(a)

The Board Can Order You Fixed First

On a breach intimation the Board may direct urgent remedial or mitigation measures before any penalty

Rule 2(1)(d)

Verifiable Means Rule 10 Or Nothing

"Verifiable consent" is a defined term: it means r.10 or r.11, and nothing else

Rule 10(1)

Proving A Parent Is An Adult

Details the Fiduciary already holds, details she provides, or a virtual token from an authorised entity

Rule 10(2)(b)

DigiLocker Counts

An authorised entity includes a Digital Locker service provider

Rule 10

Four Cases The Gazette Wrote

Child-declares vs parent-opens × already-a-user vs not — the Rules' own worked matrix

Section 9(2)

Nothing That Harms Their Well-Being

s.9(2) is absolute — no exemption in r.12 touches it

Section 9(3)

Not A Toggle. A Prohibition.

Tracking, behavioural monitoring and targeted advertising at children are barred, not consentable

Fourth Schedule

School Can Track. Advertisers Can't.

Fourth Schedule Part A(3): educational institutions, for educational activities or the child's safety

Fourth Schedule

The School Bus Exception

Transport operators may track location during the journey in the interest of safety

Fourth Schedule

Doctors And Crèches

Health, mental-health, allied-health professionals and day-care carers, each capped by necessity

Fourth Schedule

Six Purposes That Bend The Rule

Legal duties · s.7(b) benefits · an email-only account · real-time location for safety · blocking harmful content or ads · age-assurance itself

Rule 11

Guardians Of Adults

r.11: the guardian must be appointed by a court, a designated authority (RPwD Act s.15) or a local level committee (National Trust Act s.13)

Section 11(1)(a)

Ask For The Summary

A summary of your data and of the processing activities

Section 11(1)(b)

The Sharing List

s.11(1)(b): the identities of every other Data Fiduciary and Processor your data was shared with, and a description of what was shared.

Section 11(2)

Where The Sharing List Stops

It does not cover sharing with an authorised body for prevention/detection/investigation of offences, on a written request

Section 12(1)

Correct, Complete, Update

Three separate verbs, all mandatory on request

Section 12(3)

Erase

They must erase on request unless retention is needed for the specified purpose or by law

Section 13(3)

Grievance First, Board Second

You must exhaust the Fiduciary's grievance route before approaching the Board

Section 13(2)

Ninety Days Is The Grievance Cap

The corrected clock, taught properly

Section 14(1)

Nominate Someone

On death or incapacity, a nominee exercises your rights; "incapacity" is defined

Rule 14(1)

Find The Request Form

They must publish the means and the identifier they need

Rule 14(5)

Which ID They Can Ask For

Customer ID, enrolment ID, application reference, email, mobile, licence number — an identifier they issued

Section 11(1)

Only Where You Consented

A rights request goes to a Fiduciary you previously gave consent to

Section 11

Write The Request In 40 Seconds

A how-to: the six lines an access request needs

Section 15(b)

Don't Impersonate

s.15(b), the duty most likely to be broken casually

Section 15(c)

Don't Hide Material Information

On any State-issued document, identifier, proof of identity or address

Section 15(d)

False Or Frivolous Complaints

s.15(d), and the Board's power to impose costs on the complainant

Section 15(e)

Verifiably Authentic

When you ask for correction or erasure, what you furnish must be verifiably authentic

Section 8(1)

Duties Don't Excuse Them

Your failure to perform a duty does not reduce the Fiduciary's responsibility

Section 8(7)(a)

Purpose Over. Data Gone.

Erase on withdrawal or when the purpose is no longer served, whichever is earlier

Section 8(7)(b)

And The Processor's Copy

They must cause the Processor to erase what was handed over

Section 8(7)

The Bank That Must Keep It

The Act's own illustration: a ten-year KYC retention law wins

Section 8(7)

The Used-Car Listing

The Act's other illustration: sale concluded, data no longer retained

Third Schedule

Three Years Of Silence

The Third Schedule clock for big e-commerce, gaming and social platforms

Third Schedule

Two Crore And Fifty Lakh

The user thresholds: e-commerce 2 crore · gaming 50 lakh · social media 2 crore

Third Schedule

What Survives The Erasure

Account access and a virtual token redeemable for money, goods or services are carved out

Rule 8(2)

Forty-Eight Hours' Warning

They must tell you 48 hours before erasing — log in, or lose it

Seventh Schedule

Deleted Your Account? They Keep A Year.

r.8(3) + Seventh Schedule: one-year minimum retention of data, traffic data and logs — the e-book illustration

Rule 8(3)

The Cloud Provider Keeps It Too

Illustration case 2: the Fiduciary must ensure its Processor also holds the year

Section 10(1)

Nobody Is An SDF Until Notified

s.10(1) is a power to notify — no company is an SDF by size alone

Section 10(1)(a)

Six Factors

Volume and sensitivity · risk to rights · sovereignty · risk to electoral democracy · security of the State · public order

Section 10(2)(a)

A DPO Based In India

Represents the SDF, answers to the board of directors, and is the grievance contact

Section 10(2)(b)

An Independent Auditor

Not the same person as the DPO; evaluates compliance

Rule 13(1)

DPIA And Audit Every Twelve Months

The Rules put a clock on it, and require significant observations to go to the Board

Rule 13(3)

Audit Your Algorithm

Due diligence that algorithmic software is not likely to pose a risk to Data Principals' rights

Rule 13(4)

Some Data Stays In India

Specified personal data and its traffic data may be barred from leaving the country

Rule 13(5)

Who Decides That

A Central Government committee including MeitY officials

Section 2(g)

One Place To Withdraw Everything

The Consent Manager's whole promise: give, manage, review, withdraw — interoperably

Section 6(9)

Registered, Or It Isn't One

Registration with the Board is mandatory — live 13 Nov 2026

First Schedule

An Indian Company, ₹2 Crore Net Worth

First Schedule Part A conditions in one video

First Schedule

Certified Before It Starts

Independent certification against the Board's published standards and assurance framework

First Schedule

It Must Not Be Able To Read It

The Consent Manager moves your data without being able to read the contents

First Schedule

Seven Years Of Receipts

Records of consents given, denied and withdrawn, the notices, and every sharing — kept 7 years, given to you in machine-readable form

First Schedule

It Owes You A Fiduciary Duty

Part B(8) — and it may not sub-contract its obligations

First Schedule

Who Owns Your Consent Manager

It must publish promoters, directors, KMP and every 2%+ shareholder

First Schedule

It Cannot Be Sold Quietly

Control cannot change hands without the Board's prior approval

Rule 4(5)

The Board Can Switch It Off

Suspension or cancellation of registration, after a hearing, in your interests

Section 17(1)

Two Duties That Never Switch Off

Even in the s.17(1) exemptions, s.8(1) and s.8(5) — responsibility and security — still apply

Section 17(1)(a)

Enforcing A Legal Claim

s.17(1)(a)

Section 17(1)(b)

Courts And Regulators

Judicial, quasi-judicial, regulatory and supervisory functions

Section 17(1)(c)

Investigating An Offence

Prevention, detection, investigation, prosecution

Section 17(1)(d)

Outsourcing For Foreign Clients

Processing data of people outside India under a foreign contract

Section 17(1)(e)

Mergers And Demergers

Court- or tribunal-approved schemes

Section 17(1)(f)

The Loan Defaulter

Financial information of a defaulter, with the Act's own illustration and IBC definitions

Section 17(2)(a)

The State Exemption

A notified State instrumentality can be taken out entirely — and the video says plainly that this is the Act's widest door

Section 17(2)(b)

Research, Archiving, Statistics

Exempt only if no decision specific to a Data Principal is taken, and the Second Schedule standards are met

Section 17(3)

The Startup Exemption

The Government may exempt notified classes, including startups, from s.5, s.8(3), s.8(7), s.10 and s.11

Section 17(5)

Five Years To Postpone Anything

s.17(5) lets the Government suspend any provision for any class within five years of commencement

Section 16

Sending Data Abroad

s.16 blacklist power + r.15 conditions — and the honest note that no list has been notified

Section 28(1)

A Digital Office

Complaint to decision, online by design

Rule 17(1)

How Members Are Picked

Two Search-cum-Selection Committees — Cabinet Secretary for the Chairperson, MeitY Secretary for Members

Section 20(2)

Two Years At A Time

Term of two years, re-appointment allowed

Fifth Schedule

₹4.5 Lakh, No Car

The Fifth Schedule's consolidated salary, and no pension or gratuity for Board service

Section 22(3)

The Cooling-Off Year

No employment for one year after leaving without Central Government approval

Rule 19(3)

One-Third Is A Quorum

Quorum, majority vote, and the Chairperson's casting vote

Rule 19(5)

Interested? Then Don't Vote.

A Member with an interest may not participate or vote on that item

Rule 19(6)

Emergency Powers, Seven Days

Chairperson may act alone in an emergency; must inform Members within 7 days and get ratification

Section 27

Six Months To Finish An Inquiry

Extendable for recorded reasons by up to three months at a time

Section 28(7)

Civil-Court Powers

Summons, evidence on affidavit, inspection of documents

Section 28(8)

What The Board May Not Do

It may not block premises or seize equipment that would disrupt day-to-day functioning

Section 25

Public Servants

Members and officers are public servants under IPC s.21

Section 27(1)(a)

How A Complaint Starts

Intimation, complaint, Government reference, or a court's direction

Section 28(3)

Sufficient Grounds

The Board decides whether to inquire at all, and must record reasons to close

Section 28(10)

Interim Orders

Mid-inquiry orders, in writing, after a hearing

Section 27(2)

Directions Bind

The Board may issue directions any person is bound to comply with

Section 27(3)

And Can Be Revisited

Modification, suspension, withdrawal or cancellation of a direction on representation

Section 31

Mediation

The Board may send a complaint to mediation

Section 32(1)

The Voluntary Undertaking

Accepting one bars proceedings on its contents — until it's broken

Section 33(1)

Seven Penalty Slabs

The Schedule, read straight

Section 33(2)(a)

How The Number Is Chosen

Nature, gravity, duration, type of data, repetition, gain or loss, mitigation, proportionality, impact

Section 34

Where The Money Goes

Penalties are credited to the Consolidated Fund of India — not to victims

Section 37(1)

Blocked After Two Penalties

s.37: two or more penalties can lead to a Central Government blocking order that intermediaries must obey

Section 42(1)

Penalties Can Be Doubled, Not More

The Schedule may be amended by notification, capped at twice the original figure

Section 29(1)

Sixty Days To Appeal

To TDSAT, extendable for sufficient cause

Rule 22(1)

Pay The Fee By UPI

Digital filing; TRAI-Act-equivalent fee, payable over UPI, waivable by the Chairperson

Rule 22(3)

Not Bound By The CPC

Natural justice, own procedure, digital office

Section 29(6)

Six Months, Or Reasons

The Tribunal must try to finish in six months and record why if it doesn't

Section 30

Enforceable As A Decree

Tribunal orders execute like a civil court decree

Section 29(9)

Beyond The Tribunal

Appeals from TDSAT follow TRAI Act s.18

Rule 1(2)

Three Dates, Not One

13 Nov 2025 · 13 Nov 2026 · 13 May 2027 — what is live in each tranche

Rule 1(2)

The Law Is Live. Most Of It Isn't.

The Board's own provisions (ss.18-26) are live; consent, notice, rights, the breach duties and the penalties in ss.28-34 all wait for 13 May 2027.

Section 44(3)

RTI Just Changed

s.8(1)(j) of the RTI Act now exempts "information which relates to personal information"

Section 44(2)(a)

Section 43A Is Gone

s.44(2)(a) omits the IT Act's s.43A compensation provision — but s.44(2) is in the eighteen-month tranche, so 43A stands until 13 May 2027.

Section 44(1)

TDSAT Got A Third Hat

TRAI Act s.14(c) amended to add the DPDP Appellate Tribunal

Section 4

Myth: It's India's GDPR

Two grounds only, no "legitimate interest" test, no statutory DSAR clock, penalties to the Consolidated Fund — the differences that actually bite

Section 33

Myth: Compensation For Victims

The Act provides penalties, not damages to you

Section 39

Myth: You Can Sue Them

Civil courts are barred; the Board is the route

Section 10(1)(a)

Myth: Sensitive Data Is A Category

The Act has no special category of sensitive personal data. The word appears once, in s.10(1)(a); s.33(2)(b)'s nearest equivalent is “the type and nature” of the data.

Section 2(t)

Myth: Anonymised Data Is Covered

"Personal data" needs an identifiable individual

Section 3(a)(ii)

Myth: Paper Records Are Safe

Non-digital records digitised later come in

Section 35

Good Faith Protection

No suit against the Government, the Board or its officers for acts done in good faith

Section 8(7)

E-Commerce, In 40 Seconds

Third Schedule row 1 + the used-car and e-book illustrations

Third Schedule

Online Gaming

Third Schedule row 2, and the virtual-token carve-out that matters most here

Section 9(3)

Social Media

Third Schedule row 3 + the s.9(3) ban on profiling minors

Section 7(f)

Healthcare

Fourth Schedule Part A(1),(2) + the medical-emergency and epidemic uses

Section 9(3)

Schools And EdTech

Fourth Schedule Part A(3) vs the s.9(3) prohibition — where the line runs

Section 7(i)

HR And Employment

s.7(i) — what an employer may process without consent, and what it may not

Section 5

The Startup Checklist

What a small Fiduciary must do on day one, and what s.17(3) might excuse

Section 13(3)

Complain To The Board

Grievance first (s.13(3)), then the digital complaint

Section 6(4)

Withdraw Everything Today

Using s.6(4) and r.3(c)(i) on the apps you already have

Rule 14(3)

One Page, Every Right You Have

The closer: the whole of Chapter III on one board, with the 90-day grievance cap in its correct place

Section 19(1)

Who Can Sit On The Board

Ability, integrity and standing, and at least one member must be an expert in law

Section 23(2)

A Vacancy Doesn't Void A Decision

No act of the Board is invalid merely for a vacancy, a defective appointment, or an irregularity that doesn't touch the merits

Section 24

The Board Hires Its Own

Officers and employees appointed with the Central Government's prior approval

Section 26(a)

What The Chairperson Alone Can Do

General superintendence, authorising scrutiny of any complaint, and allocating proceedings among Members

Section 36

The Government Can Ask The Board Anything

s.36 — the Centre may require the Board, any Data Fiduciary or any intermediary to furnish information

Section 40(1)

Where The Rules Come From

s.40(2) runs (a) to (z) — twenty-five named rule-making subjects and one catch-all — so the Rules you are governed by are the exercise of a list written into the Act.

Section 41

Parliament Can Strike A Rule Down

Every rule and s.16/s.42 notification is laid before both Houses for thirty days and can be modified or annulled

Section 43(1)

Three Years To Fix A Mistake

The difficulty-removal power expires three years after commencement, and every such order is laid before Parliament

Fifth Schedule

What The Board Is Paid

The Fifth Schedule's consolidated salary, without house or car — and no pension and no gratuity for service in the Board.

Sixth Schedule

Deputation, Not A Career

Board staff come on deputation for not more than five years, including from the National Institute for Smart Government

Seventh Schedule

The Order You Are Never Told About

r.23(2): where disclosure would prejudice sovereignty, integrity or security, the Government may forbid the Fiduciary from telling you it handed your data over

Sixth Schedule

Sixth Schedule, In Plain Words

Gratuity, travel, medical, leave and conduct rules for Board staff — the boring half of independence