Section 40 Power to make rules
- Chapter
- IX · Miscellaneous
40. (1) The Central Government may, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.
(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:-
(a) the manner in which the notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall inform her, under sub-section (1) of section 5
(b) the manner in which the notice given by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall inform her, under sub-section (2) of section 5;
(c) the manner of accountability and the obligations of Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform under sub-section (8) of section 6;
(d) the manner of registration of Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform and the conditions relating thereto, under sub-section (9) of section 6;
(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data may be processed under clause (b) of section 7;
(f) the form and manner of intimation of personal data breachDefined in section 2(u): personal data breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data to the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (6) of section 8;
(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;
(h) the manner of publishing the business contact information of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10 under sub-section (9) of section 8;
(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;
(j) the classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries, the purposes of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a childDefined in section 2(f): child means an individual who has not completed the age of eighteen years and the conditions relating thereto, under sub-section (4) of section 9;
(k) the other matters comprising the process of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;
(l) the other measures that the Significant Data FiduciaryDefined in section 2(z): Significant Data Fiduciary means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (za) specified purpose means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules... shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;
(m) the manner in which a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall make a request to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to obtain information and any other information related to the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and its processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure..., under sub-section (1) of section 11;
(n) the manner in which a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall make a request to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data for erasure of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data under sub-section (3) of section 12;
(o) the period within which the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall respond to any grievances under sub-section (2) of section 13;
(p) the manner of nomination of any other individual by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf under sub-section (1) of section 14;
(q) the standards for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for exemption under clause (b) of sub-section (2) of section 17;
(r) the manner of appointment of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (2) of section 19;
(s) the salary, allowances and other terms and conditions of services of the ChairpersonDefined in section 2(e): Chairperson means the Chairperson of the Board and other Members of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (1) of section 20;
(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;
(u) the terms and conditions of appointment and service of officers and employees of the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under section 24;
(v) the techno-legal measures to be adopted by the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 under sub-section (1) of section 28;
(w) the other matters under clause (d) of sub-section (7) of section 28;
(z) any other matter which is to be or may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act or in respect of which provision is to be, or may be, made by rules.