Section 44 adds the Appellate Tribunal under the Digital Personal Data Protection Act, 2023 to appellate tribunal references under the Telecom Regulatory Authority of India Act, 1997. It omits the sensitive personal data protection compensation provision and related rule-making provision in the Information Technology Act, 2000, while preserving the application of the Digital Personal Data Protection Act, 2023 despite the overriding clause. It also revises the Right to Information Act, 2005 exemption to cover information relating to personal information.

Section 43 permits the Central Government to issue Official Gazette orders, consistent with the Digital Personal Data Protection Act, 2023, where necessary or expedient to remove difficulties in implementing it. This power may be exercised only within three years from the Act's commencement. Each order must be laid before both Houses of Parliament as soon as practicable after it is made.

Section 42 empowers the Central Government to amend the Schedule by notification, while limiting any increase in a scheduled penalty to no more than twice the amount specified when the statute was originally enacted. An amendment made under this power operates as though enacted within the statute and takes effect on the date of its notification.

Parliamentary scrutiny applies to every rule made and notification issued under sections 16 and 42 of the Digital Personal Data Protection Act, 2023, which must be laid before each House while in session for an aggregate thirty-day period. Both Houses may jointly modify or annul an instrument before expiry of the following session; modification or annulment does not affect the validity of anything previously done under it.

The Central Government may make rules, after previous publication, for implementing the Digital Personal Data Protection Act, 2023. Rules may regulate Data Fiduciary notices, Consent Manager accountability and registration, personal data breach intimation, verifiable consent, children's data processing, Data Protection Impact Assessments, and obligations of Significant Data Fiduciaries. They may also prescribe procedures for Data Principal information and erasure requests, grievances, nominations, exempt processing standards, Board administration, techno-legal measures, and appeals.

Bar of civil court jurisdiction excludes suits or proceedings concerning matters within the Board's statutory powers. Courts and other authorities cannot grant injunctions against actions taken, or proposed to be taken, under powers conferred by the Digital Personal Data Protection Act, 2023. The provision takes effect from 13 November 2025.

Section 38 preserves the concurrent operation of other laws by providing that the Digital Personal Data Protection Act, 2023 applies in addition to, and does not derogate from, applicable law. Where its provisions conflict with another law in force, the Digital Personal Data Protection Act, 2023 prevails only to the extent of the conflict. The framework takes effect from 13 November 2025.

Central Government may direct public blocking of information linked to a computer resource used by a repeatedly penalised Data Fiduciary to offer goods or services in India. The power arises on a written Board reference, requires an opportunity of hearing for the Data Fiduciary, and depends on recorded reasons that blocking is necessary or expedient in the general public interest. Intermediaries receiving such directions must comply, and relevant technical terms carry their Information Technology Act meanings.

Section 36 empowers the Central Government to require the Board, any Data Fiduciary, or any intermediary to furnish information it calls for for purposes of the digital personal data protection regime. The power applies to every specified entity, remains confined to those purposes, and comes into force eighteen months after 13 November 2025.

Section 35 provides good-faith protection to the Central Government, the Board, and their Chairperson, Members, officers and employees. It bars suits, prosecutions and other legal proceedings concerning acts done, or intended to be done, in good faith under the Digital Personal Data Protection Act, 2023 or rules made under it. The provision is to take effect on 13 November 2025.

All sums realised from penalties imposed by the Board under the Digital Personal Data Protection Act, 2023 must be credited to the Consolidated Fund of India. The provision governs the destination of monetary penalties collected through the Act's adjudicatory framework and is stated to take effect eighteen months from 13 November 2025.

Section 33 permits the Board, after an inquiry and an opportunity of being heard, to impose the scheduled monetary penalty for a significant breach of data protection obligations or rules. The penalty amount must reflect the breach's severity, duration, affected personal data, repetition, gains or avoided losses, mitigation measures, proportionality, deterrent effect, and likely impact on the person.

Section 32 establishes a voluntary undertaking mechanism allowing the Board, at any stage of proceedings under section 28, to accept commitments concerning observance of the Act. Terms may require action within a prescribed period, restraint from action, or publicisation. Acceptance bars further proceedings concerning covered matters, but non-compliance is deemed a breach of the Act and permits proceedings under section 33 after an opportunity of being heard.

Section 31 establishes alternate dispute resolution for complaints under the Digital Personal Data Protection Act, 2023. Where the Board considers mediation suitable, it may direct concerned parties to attempt resolution through mediation. The mediator may be selected by mutual agreement of the parties or as provided under applicable Indian law. The mechanism takes effect eighteen months from 13 November 2025.

Orders of the Appellate Tribunal under the Digital Personal Data Protection Act, 2023, are enforceable by the Tribunal as civil-court decrees, with all powers of a civil court for that purpose. The Tribunal may alternatively transmit an order to the civil court having local jurisdiction, which must execute it as its own decree.

Appeals against orders or directions of the Board lie to the Appellate Tribunal for any aggrieved person. An appeal must be filed within sixty days of receiving the challenged order or direction, in the prescribed form and manner and with the prescribed fee. Delay may be condoned where sufficient cause is shown. After affording parties an opportunity to be heard, the Appellate Tribunal may confirm, modify, or set aside the challenged order.

Bail in allegations of fraudulent loan transactions requires assessment of the prima facie case, offence gravity and societal impact, public interest, and the risk of interference with justice. Alleged concerted siphoning of co-operative bank funds through loans was treated as seriously affecting depositors and the banking system. Temporary bail intended to enable recovery had not resulted in recovery. Alleged influence of the accused, together with a genuine apprehension of evidence tampering and interference with pending proceedings, weighed against release. Bail was therefore denied.

The Board must operate independently and, as far as practicable, through a digital office. It must determine whether sufficient grounds exist before commencing an inquiry, record reasons for closure or further action, and conduct inquiries according to principles of natural justice. The Board has specified civil-court powers for evidence gathering and inspection, but cannot disrupt day-to-day functioning by restricting premises access or taking custody of essential equipment. Interim orders require a hearing and recorded reasons, while false or frivolous complaints may result in warnings or costs.

Upon intimation of a personal data breach, the Data Protection Board may order urgent remedial or mitigation measures, inquire into the breach, and impose prescribed penalties. It may investigate specified breaches involving Data Fiduciaries, Consent Managers, and intermediaries on prescribed complaints, references, or directions. After hearing the person concerned and recording written reasons, it may issue binding directions. On an affected person's representation or Central Government reference, it may modify, suspend, withdraw, or cancel directions, subject to conditions.

The Chairperson exercises general superintendence over the Board's administrative matters and may issue directions. Board officers may be authorised to scrutinise intimations, complaints, references and correspondence. The Chairperson may also authorise individual Members or groups of Members to perform Board functions and conduct proceedings, and may allocate proceedings among them.