Section 6(2)
The Consent That Was Never Valid
A bundled waiver of the right to complain to the Board is invalid to the extent of the infringement — the Act's own insurer illustration
208 short, section-by-section video explainers of India's DPDP Act, scripted in English with a Hindi dub for each. Every card below links to the dpdpact.info guide page for that exact section.
1 of 208 are live on YouTube right now. The rest are uploading in daily batches (4-6/day, YouTube's own quota ceiling) — check back, or re-run this page's build script after each batch.
Section 6(2)
A bundled waiver of the right to complain to the Board is invalid to the extent of the infringement — the Act's own insurer illustration
Section 6(1)
Consent is capped at the data necessary for the specified purpose — the Act's own telemedicine illustration
Section 15
The duties of a Data Principal carry their own penalty: ₹250 crore for the company, ₹10,000 for you
Section 13(2)
The rights clock, corrected: ninety days is the grievance cap, and the s.11 sharing list is the right almost nobody uses
Section 2(f)
Under-18 is a child here, and tracking, behavioural monitoring and targeted advertising at children are prohibited outright
Section 2(j)
The Act names *you*, and for a child or a person with disability the name includes the parent or guardian
Section 2(i)
The test is purpose and means, never possession — and “alone or in conjunction with other persons” means two deciders are two Data Fiduciaries.
Section 2(k)
The Processor works for the Fiduciary; the Fiduciary stays responsible for it no matter what the contract says
Section 2(t)
"any data about an individual who is identifiable by or in relation to such data" — wider than a name
Section 3(a)
The Act covers digital personal data, and paper that is digitised later
Section 2(x)
The enacted list runs from collection to destruction and is only illustrative — “includes operations such as” — so storage and erasure are both processing.
Section 2(u)
Accidental disclosure, loss of access, alteration — availability counts, so ransomware and a deleted backup are both breaches
Section 2(y)
s.2(y) makes "she" gender-neutral throughout the statute — a drafting choice worth one video
Section 2(s)
"person" includes an individual, HUF, company, firm, AoP, the State, and every artificial juristic person
Section 2(za)
The purpose is whatever the notice stated — so the notice is the boundary of what they may do
Section 2(o)
The Act defines *gain* and *loss* — they set the Board's penalty calculus later
Section 2(g)
A registered single point to give, manage, review and withdraw consent
Section 3(a)
Applies to digital personal data processed in India, collected digitally or digitised later
Section 3(b)
Processing outside India is covered if it relates to offering goods or services to people in India
Section 3(c)(i)
Personal or domestic purpose is outside the Act
Section 3(c)(ii)(A)
Data the Data Principal made public is outside the Act — the Act's own blogging illustration
Section 3(c)(ii)(B)
Data someone else is legally obliged to publish is also outside
Section 4(1)
Consent, or "certain legitimate uses". There is no third door — no "legitimate interest" balancing test
Section 4(2)
"Lawful purpose" is defined negatively: any purpose not expressly forbidden by law
Section 38
On conflict, this Act prevails to the extent of the conflict — but it is *in addition to*, not in derogation of, other laws
Section 39
Civil courts are barred where the Board is empowered; no injunctions either
Section 13(2)
The corrective video — 90 days is the *grievance* cap (r.14(3)); rights requests have no statutory clock
Section 5(1)
Every consent request must be accompanied or preceded by a notice
Rule 3(b)(i)
The notice must carry an itemised description of the personal data
Rule 3(b)(ii)
It must describe the specific goods, services or uses the processing enables — not just "to improve services"
Rule 3(a)
The notice has to be understandable independently of anything else on the page
Rule 3(c)
Withdraw consent · exercise rights · complain to the Board — as an actual link, in the notice
Section 5(3)
Notice and consent request must be available in English or any Eighth Schedule language
Section 5(2)
Pre-commencement consent survives, but they must send you the notice "as soon as reasonably practicable"
Section 6(1)
Free, specific, informed, unconditional, unambiguous — with a clear affirmative action
Section 6(1)
"Clear affirmative action" kills the pre-ticked box and the scroll-is-consent pattern
Section 6(1)
Consent is limited to the data necessary for the specified purpose — the Act’s own telemedicine contact-list illustration.
Section 6(2)
An unlawful part of a consent is invalid only to that extent; the rest of the consent survives.
Section 6(4)
Withdrawal must be comparable in ease to giving — the Act and the Rules both say it
Section 6(5)
You bear the consequences; processing before withdrawal stays lawful — the shopping-order illustration
Section 6(6)
After withdrawal the Fiduciary must cease and cause its Processors to cease — the telecom-billing illustration
Section 6(10)
In a proceeding the burden is on the Fiduciary to prove notice and consent
Section 7(a)
Data voluntarily provided for a purpose, with no objection indicated, needs no separate consent — the pharmacy receipt illustration
Section 7(a)
The broker illustration: once you say you no longer need help, processing must stop
Section 7(b)
The State may process for a subsidy, benefit, service, certificate, licence or permit where you consented before, or where it already holds the data in a notified database.
Section 7(b)
The Act's own illustration of eligibility-checking for another benefit
Rule 5(2)
Consolidated Fund, public account, or a local authority's funds — the Rules define the phrase
Second Schedule
Second Schedule: lawful, purpose-limited, minimal, accurate, retention-limited, secured, accountable — plus an intimation to you and a contact person
Section 7(c)
Performance of a legal function, or sovereignty, integrity and security of the State
Section 7(d)
Compliance with a statutory disclosure obligation is a legitimate use
Section 7(e)
Judgments and decrees in India, and foreign civil/contractual orders
Section 7(f)
A threat to life or immediate threat to health — yours or anyone's
Section 7(g)
Public-health measures, and safety during a disaster or breakdown of public order (disaster = Disaster Management Act, 2005 s.2(d))
Section 7(i)
Employment purposes, and safeguarding the employer from loss or liability — espionage, trade secrets, IP, classified information
Section 8(1)
Responsibility holds irrespective of any agreement to the contrary and even if *you* broke your duties
Section 8(2)
A Processor may only be engaged under a valid contract
Section 8(3)
Completeness, accuracy and consistency are mandatory where the data will drive a decision about you or be shared onward
Section 8(4)
Appropriate technical and organisational measures for effective observance
Section 8(5)
Reasonable security safeguards — the single most expensive obligation in the Act
Rule 6(1)(a)
The Rules' minimum list starts with encryption, obfuscation, masking or virtual tokens
Rule 6(1)(c)
Logs, monitoring and review, so unauthorised access can be detected, investigated and stopped from recurring
Rule 6(1)(e)
One-year retention of logs and data for detection and investigation
Rule 6(1)(d)
Reasonable measures for continued processing if confidentiality, integrity or availability is compromised
Rule 6(1)(f)
The Processor contract must carry the safeguards clause
Section 8(9)
Publish the DPO's or a responsible person's business contact — and repeat it in every reply to a rights request
Section 8(10)
An *effective* mechanism is the obligation; "effective" is the operative word
Rule 7(2)(b)
72 hours is the Board's deadline; your own intimation is "without delay" with no number
Rule 7(1)(a)
Description · consequences for you · mitigation · what you should do · a human contact
Rule 7(1)
Measured against r.7(1)'s five items, the standard PR breach email fails four of them
Rule 7(2)(a)
Without delay: nature, extent, timing, location, likely impact
Rule 7(2)(b)(i)
Six items including findings on who caused it and a report on what victims were told
Rule 7(2)(b)
The 72 hours extends only on a written request the Board allows
Section 8(6)
Schedule item 2 — failing to notify the Board or you
Rule 7(1)
Intimation goes through your user account or a channel you registered — so a dead email address is their problem, not a defence
Section 2(u)
Ransomware, a wiped backup, an expired key: availability is in the definition
Section 27(1)(a)
On a breach intimation the Board may direct urgent remedial or mitigation measures before any penalty
Rule 2(1)(d)
"Verifiable consent" is a defined term: it means r.10 or r.11, and nothing else
Rule 10(1)
Details the Fiduciary already holds, details she provides, or a virtual token from an authorised entity
Rule 10(2)(b)
An authorised entity includes a Digital Locker service provider
Rule 10
Child-declares vs parent-opens × already-a-user vs not — the Rules' own worked matrix
Section 9(2)
s.9(2) is absolute — no exemption in r.12 touches it
Section 9(3)
Tracking, behavioural monitoring and targeted advertising at children are barred, not consentable
Fourth Schedule
Fourth Schedule Part A(3): educational institutions, for educational activities or the child's safety
Fourth Schedule
Transport operators may track location during the journey in the interest of safety
Fourth Schedule
Health, mental-health, allied-health professionals and day-care carers, each capped by necessity
Fourth Schedule
Legal duties · s.7(b) benefits · an email-only account · real-time location for safety · blocking harmful content or ads · age-assurance itself
Rule 11
r.11: the guardian must be appointed by a court, a designated authority (RPwD Act s.15) or a local level committee (National Trust Act s.13)
Section 11(1)(a)
A summary of your data and of the processing activities
Section 11(1)(b)
s.11(1)(b): the identities of every other Data Fiduciary and Processor your data was shared with, and a description of what was shared.
Section 11(2)
It does not cover sharing with an authorised body for prevention/detection/investigation of offences, on a written request
Section 12(1)
Three separate verbs, all mandatory on request
Section 12(3)
They must erase on request unless retention is needed for the specified purpose or by law
Section 13(3)
You must exhaust the Fiduciary's grievance route before approaching the Board
Section 13(2)
The corrected clock, taught properly
Section 14(1)
On death or incapacity, a nominee exercises your rights; "incapacity" is defined
Rule 14(1)
They must publish the means and the identifier they need
Rule 14(5)
Customer ID, enrolment ID, application reference, email, mobile, licence number — an identifier they issued
Section 11(1)
A rights request goes to a Fiduciary you previously gave consent to
Section 11
A how-to: the six lines an access request needs
Section 15(b)
s.15(b), the duty most likely to be broken casually
Section 15(c)
On any State-issued document, identifier, proof of identity or address
Section 15(d)
s.15(d), and the Board's power to impose costs on the complainant
Section 15(e)
When you ask for correction or erasure, what you furnish must be verifiably authentic
Section 8(1)
Your failure to perform a duty does not reduce the Fiduciary's responsibility
Section 8(7)(a)
Erase on withdrawal or when the purpose is no longer served, whichever is earlier
Section 8(7)(b)
They must cause the Processor to erase what was handed over
Section 8(7)
The Act's own illustration: a ten-year KYC retention law wins
Section 8(7)
The Act's other illustration: sale concluded, data no longer retained
Third Schedule
The Third Schedule clock for big e-commerce, gaming and social platforms
Third Schedule
The user thresholds: e-commerce 2 crore · gaming 50 lakh · social media 2 crore
Third Schedule
Account access and a virtual token redeemable for money, goods or services are carved out
Rule 8(2)
They must tell you 48 hours before erasing — log in, or lose it
Seventh Schedule
r.8(3) + Seventh Schedule: one-year minimum retention of data, traffic data and logs — the e-book illustration
Rule 8(3)
Illustration case 2: the Fiduciary must ensure its Processor also holds the year
Section 10(1)
s.10(1) is a power to notify — no company is an SDF by size alone
Section 10(1)(a)
Volume and sensitivity · risk to rights · sovereignty · risk to electoral democracy · security of the State · public order
Section 10(2)(a)
Represents the SDF, answers to the board of directors, and is the grievance contact
Section 10(2)(b)
Not the same person as the DPO; evaluates compliance
Rule 13(1)
The Rules put a clock on it, and require significant observations to go to the Board
Rule 13(3)
Due diligence that algorithmic software is not likely to pose a risk to Data Principals' rights
Rule 13(4)
Specified personal data and its traffic data may be barred from leaving the country
Rule 13(5)
A Central Government committee including MeitY officials
Section 2(g)
The Consent Manager's whole promise: give, manage, review, withdraw — interoperably
Section 6(9)
Registration with the Board is mandatory — live 13 Nov 2026
First Schedule
First Schedule Part A conditions in one video
First Schedule
Independent certification against the Board's published standards and assurance framework
First Schedule
The Consent Manager moves your data without being able to read the contents
First Schedule
Records of consents given, denied and withdrawn, the notices, and every sharing — kept 7 years, given to you in machine-readable form
First Schedule
Part B(8) — and it may not sub-contract its obligations
First Schedule
It must publish promoters, directors, KMP and every 2%+ shareholder
First Schedule
Control cannot change hands without the Board's prior approval
Rule 4(5)
Suspension or cancellation of registration, after a hearing, in your interests
Section 17(1)
Even in the s.17(1) exemptions, s.8(1) and s.8(5) — responsibility and security — still apply
Section 17(1)(a)
s.17(1)(a)
Section 17(1)(b)
Judicial, quasi-judicial, regulatory and supervisory functions
Section 17(1)(c)
Prevention, detection, investigation, prosecution
Section 17(1)(d)
Processing data of people outside India under a foreign contract
Section 17(1)(e)
Court- or tribunal-approved schemes
Section 17(1)(f)
Financial information of a defaulter, with the Act's own illustration and IBC definitions
Section 17(2)(a)
A notified State instrumentality can be taken out entirely — and the video says plainly that this is the Act's widest door
Section 17(2)(b)
Exempt only if no decision specific to a Data Principal is taken, and the Second Schedule standards are met
Section 17(3)
The Government may exempt notified classes, including startups, from s.5, s.8(3), s.8(7), s.10 and s.11
Section 17(5)
s.17(5) lets the Government suspend any provision for any class within five years of commencement
Section 16
s.16 blacklist power + r.15 conditions — and the honest note that no list has been notified
Section 28(1)
Complaint to decision, online by design
Rule 17(1)
Two Search-cum-Selection Committees — Cabinet Secretary for the Chairperson, MeitY Secretary for Members
Section 20(2)
Term of two years, re-appointment allowed
Fifth Schedule
The Fifth Schedule's consolidated salary, and no pension or gratuity for Board service
Section 22(3)
No employment for one year after leaving without Central Government approval
Rule 19(3)
Quorum, majority vote, and the Chairperson's casting vote
Rule 19(5)
A Member with an interest may not participate or vote on that item
Rule 19(6)
Chairperson may act alone in an emergency; must inform Members within 7 days and get ratification
Section 27
Extendable for recorded reasons by up to three months at a time
Section 28(7)
Summons, evidence on affidavit, inspection of documents
Section 28(8)
It may not block premises or seize equipment that would disrupt day-to-day functioning
Section 25
Members and officers are public servants under IPC s.21
Section 27(1)(a)
Intimation, complaint, Government reference, or a court's direction
Section 28(3)
The Board decides whether to inquire at all, and must record reasons to close
Section 28(10)
Mid-inquiry orders, in writing, after a hearing
Section 27(2)
The Board may issue directions any person is bound to comply with
Section 27(3)
Modification, suspension, withdrawal or cancellation of a direction on representation
Section 31
The Board may send a complaint to mediation
Section 32(1)
Accepting one bars proceedings on its contents — until it's broken
Section 33(1)
The Schedule, read straight
Section 33(2)(a)
Nature, gravity, duration, type of data, repetition, gain or loss, mitigation, proportionality, impact
Section 34
Penalties are credited to the Consolidated Fund of India — not to victims
Section 37(1)
s.37: two or more penalties can lead to a Central Government blocking order that intermediaries must obey
Section 42(1)
The Schedule may be amended by notification, capped at twice the original figure
Section 29(1)
To TDSAT, extendable for sufficient cause
Rule 22(1)
Digital filing; TRAI-Act-equivalent fee, payable over UPI, waivable by the Chairperson
Rule 22(3)
Natural justice, own procedure, digital office
Section 29(6)
The Tribunal must try to finish in six months and record why if it doesn't
Section 30
Tribunal orders execute like a civil court decree
Section 29(9)
Appeals from TDSAT follow TRAI Act s.18
Rule 1(2)
13 Nov 2025 · 13 Nov 2026 · 13 May 2027 — what is live in each tranche
Rule 1(2)
The Board's own provisions (ss.18-26) are live; consent, notice, rights, the breach duties and the penalties in ss.28-34 all wait for 13 May 2027.
Section 44(3)
s.8(1)(j) of the RTI Act now exempts "information which relates to personal information"
Section 44(2)(a)
s.44(2)(a) omits the IT Act's s.43A compensation provision — but s.44(2) is in the eighteen-month tranche, so 43A stands until 13 May 2027.
Section 44(1)
TRAI Act s.14(c) amended to add the DPDP Appellate Tribunal
Section 4
Two grounds only, no "legitimate interest" test, no statutory DSAR clock, penalties to the Consolidated Fund — the differences that actually bite
Section 33
The Act provides penalties, not damages to you
Section 39
Civil courts are barred; the Board is the route
Section 10(1)(a)
The Act has no special category of sensitive personal data. The word appears once, in s.10(1)(a); s.33(2)(b)'s nearest equivalent is “the type and nature” of the data.
Section 2(t)
"Personal data" needs an identifiable individual
Section 3(a)(ii)
Non-digital records digitised later come in
Section 35
No suit against the Government, the Board or its officers for acts done in good faith
Section 8(7)
Third Schedule row 1 + the used-car and e-book illustrations
Third Schedule
Third Schedule row 2, and the virtual-token carve-out that matters most here
Section 9(3)
Third Schedule row 3 + the s.9(3) ban on profiling minors
Section 7(f)
Fourth Schedule Part A(1),(2) + the medical-emergency and epidemic uses
Section 9(3)
Fourth Schedule Part A(3) vs the s.9(3) prohibition — where the line runs
Section 7(i)
s.7(i) — what an employer may process without consent, and what it may not
Section 5
What a small Fiduciary must do on day one, and what s.17(3) might excuse
Section 13(3)
Grievance first (s.13(3)), then the digital complaint
Section 6(4)
Using s.6(4) and r.3(c)(i) on the apps you already have
Rule 14(3)
The closer: the whole of Chapter III on one board, with the 90-day grievance cap in its correct place
Section 19(1)
Ability, integrity and standing, and at least one member must be an expert in law
Section 23(2)
No act of the Board is invalid merely for a vacancy, a defective appointment, or an irregularity that doesn't touch the merits
Section 24
Officers and employees appointed with the Central Government's prior approval
Section 26(a)
General superintendence, authorising scrutiny of any complaint, and allocating proceedings among Members
Section 36
s.36 — the Centre may require the Board, any Data Fiduciary or any intermediary to furnish information
Section 40(1)
s.40(2) runs (a) to (z) — twenty-five named rule-making subjects and one catch-all — so the Rules you are governed by are the exercise of a list written into the Act.
Section 41
Every rule and s.16/s.42 notification is laid before both Houses for thirty days and can be modified or annulled
Section 43(1)
The difficulty-removal power expires three years after commencement, and every such order is laid before Parliament
Fifth Schedule
The Fifth Schedule's consolidated salary, without house or car — and no pension and no gratuity for service in the Board.
Sixth Schedule
Board staff come on deputation for not more than five years, including from the National Institute for Smart Government
Seventh Schedule
r.23(2): where disclosure would prejudice sovereignty, integrity or security, the Government may forbid the Fiduciary from telling you it handed your data over
Sixth Schedule
Gratuity, travel, medical, leave and conduct rules for Board staff — the boring half of independence
No videos match that search.