Section 16 permits the Central Government to restrict a Data Fiduciary's transfer of personal data for processing in specified foreign countries or territories. Indian laws imposing higher protection or stricter overseas-transfer restrictions remain applicable to particular personal data, Data Fiduciaries, or classes of Data Fiduciaries. Commencement is specified as eighteen months from 13 November 2025.

Data Principals must comply with applicable laws when exercising rights, avoid impersonation and suppression of material information, and refrain from lodging false or frivolous grievances or complaints. Personal data provided for documents, unique identifiers, identity proofs, or address proofs must not omit material information. Correction or erasure requests must contain only verifiably authentic information.

Section 14 gives a Data Principal the right to nominate another individual in the prescribed manner. The nominee may exercise the Data Principal's rights upon death or incapacity. Incapacity means inability to exercise those rights due to unsoundness of mind or bodily infirmity.

Data Fiduciaries and Consent Managers must provide readily available means for Data Principals to seek redress for acts or omissions affecting personal-data obligations or the exercise of rights. They must respond to every grievance within the prescribed period applicable to the relevant class. Data Principals must exhaust this grievance-redressal opportunity before approaching the Board.

Data Principals may seek correction, completion, updating and erasure of personal data processed with prior consent, subject to applicable legal requirements and procedures. Data Fiduciaries must correct inaccurate or misleading data, complete incomplete data and update data upon request. Erasure must follow a prescribed request unless retention is necessary for the specified purpose or compliance with law.

A Data Principal who has previously given consent for personal-data processing may request a summary of processed data, related processing activities, and prescribed information from the relevant Data Fiduciary. The Data Principal may also obtain the identities of other Data Fiduciaries and Data Processors with whom the data has been shared, and a description of the data shared. This disclosure does not apply to legally authorised sharing pursuant to a written request for specified law-enforcement or cyber-incident purposes.

Significant Data Fiduciaries must appoint an India-based Data Protection Officer accountable to their board or similar governing body and acting as the grievance-redressal contact. They must appoint an independent data auditor to evaluate compliance and conduct periodic Data Protection Impact Assessments, periodic data audits, and prescribed additional measures. Designation may follow an assessment of personal-data volume and sensitivity, risks to Data Principals' rights, and potential effects on sovereignty, electoral democracy, State security, and public order.

Processing of personal data of a child, or of a person with disability who has a lawful guardian, requires verifiable consent from the parent or lawful guardian in the prescribed manner. Processing likely to cause a detrimental effect on a child's well-being is prohibited. Data Fiduciaries must not track or behaviourally monitor children, or direct targeted advertising at them. Prescribed exemptions and age-based exemptions for verifiably safe processing may apply.

Data Fiduciaries remain responsible for compliance in respect of personal-data processing undertaken by them or through Data Processors. Processor engagement for goods or services activities requires a valid contract. Fiduciaries must maintain data accuracy where decisions affecting Data Principals or disclosures are involved, apply technical and organisational safeguards, and notify the Board and affected Data Principals of breaches. They must erase data upon consent withdrawal or when the specified purpose ends, subject to legally required retention, and provide contact information and grievance redressal.

Data Fiduciaries may process personal data for a voluntarily supplied specified purpose unless the Data Principal indicates non-consent, and must cease processing where requested assistance is no longer needed. State entities may process data for prescribed public delivery where prior consent or notified government records exist, subject to applicable standards. Further legitimate uses include statutory functions and disclosures, legal-order compliance, medical emergencies, public-health threats, disasters, public-order breakdowns, and employment-related safeguards against loss or liability.

Consent for personal-data processing must be free, specific, informed, unconditional and unambiguous, based on clear affirmative action, and limited to data necessary for the stated purpose. Consent requests must be clear, accessible in prescribed languages, and provide relevant contact details. Data Principals may withdraw consent as easily as it was given; the Data Fiduciary and its Data Processors must then cease processing within a reasonable time unless processing is legally required or authorised. Where consent is disputed, the Data Fiduciary must prove compliant notice and consent.

A Data Fiduciary seeking consent must give or precede its request with notice identifying the personal data proposed for processing, the processing purpose, the Data Principal's rights, and the complaint mechanism before the Board. For consent obtained before commencement, equivalent information must be provided as soon as reasonably practicable, while processing may continue until consent is withdrawn. Notices must be accessible in English or an Eighth Schedule language.

Processing of a Data Principal's personal data is permitted only in accordance with the Act, for a lawful purpose, and on the basis of consent or certain legitimate uses. A lawful purpose is one not expressly forbidden by law. These alternative grounds govern the basis for processing within Data Fiduciary obligations. Section 4 is to come into force eighteen months after 13 November 2025.

Section 3 governs processing of digital personal data collected in India in digital form or subsequently digitised, and extends to overseas processing connected with offering goods or services to Data Principals in India. It excludes personal or domestic processing by individuals and personal data publicly made available by the Data Principal or by a person legally required to disclose it. The provision takes effect eighteen months from 13 November 2025.

Digital personal data protection definitions identify the Data Principal, Data Fiduciary, Data Processor, Consent Manager, Significant Data Fiduciary and Data Protection Officer. Processing includes automated operations involving collection, storage, use, sharing, disclosure, restriction, erasure and destruction of digital personal data. Personal data breach covers unauthorised processing and accidental events compromising confidentiality, integrity or availability. The framework also provides for digital proceedings, Board-registered consent management, specified purpose, certain legitimate uses, and broad meanings of person, gain and loss.

Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data that recognises individuals' right to protect personal data while permitting processing for lawful purposes. Commencement occurs on dates appointed by Central Government notification, and different provisions may commence on different dates. References to commencement are provision-specific, with commencement indicated with effect from 13 November 2025.

Fees collected for investment advisory services provided without required registration cannot be retained merely because no investor responds to a refund invitation. Such amounts must be deposited with the regulator, which must invite and verify investor claims. Any balance remaining unclaimed after that process must be transferred to the Investor Protection Fund. The absence of refund claims does not legitimise retention of fees earned through unregistered investment advisory activity.

Digital personal data may be processed only for a lawful purpose based on valid consent or specified legitimate uses. Consent must be free, specific, informed, unconditional and unambiguous, supported by clear notice, and withdrawable with comparable ease. Data Fiduciaries remain responsible for processing undertaken by themselves or their processors, must maintain security safeguards, notify personal data breaches, erase data when no longer needed unless legal retention is required, and provide grievance redressal. Children's data requires verifiable parental or guardian consent, with restrictions on harmful processing, tracking, behavioural monitoring and targeted advertising.

Section 153D prior approval for search assessments requires the approving authority to independently examine draft assessment orders, assessment records and relevant search material for each assessment year. A composite approval issued without evidence of record movement, separate year-wise consideration, reasons or verification indicates a routine and mechanical exercise rather than informed statutory approval. Approval granted in this manner is invalid for want of application of mind, and assessment orders founded on it are vitiated and liable to be quashed.

In an unabated assessment under Section 153A, additions require incriminating material found during the search and a link between that material and the proposed addition. An unsecured-loan addition lacking that nexus is unsustainable. Alleged unexplained-expense additions are likewise unsustainable where seized entries are reconciled with agreements and books, verification reveals no adverse discrepancy, and the transactions represent genuine accounted business dealings. These principles support deletion of additions founded on recorded expenses or loans unconnected with incriminating search material.