Appendix A — Registry of Sections and Rules

A.1 Reading and maintaining the canonical view

This appendix and Chapter 2’s operational-alias view are generated from research/legal/CANONICAL_PROVISION_REGISTER.json. Every displayed row resolves to a full record containing exact primary passage, physical newline range, URL, source version, instrument date, PDF/text SHA-256, commencement source, actor, trigger, conditions, exceptions, author interpretation and review status. Physical source lines are counted by newline; a PDF form feed does not create another numbered line. The small table is navigation to this populated register, not a replacement for its exact legal text.

A hash establishes source identity, not correctness of interpretation. author primary-text checked is not counsel approval. No claimed portal operation, appointment, supplier test or customer outcome can be established by these hashes. Implementation evidence must be supplied separately. The source manifest in out/remediation/Q02/source-manifest.json preserves reviewed URLs, dates and actual file hashes without altering Q01’s retained originals.

The Act’s first tranche is Section 1(2), Section 2, Sections 18 to 26, Section 35, Sections 38 to 43 and Section 44(1),(3), from 13 November 2025. The register’s whole-section summaries for Sections 1/6/27/44 must be read with these sub-provision splits: Section 6(9) and Section 27(1)(d) are scheduled for 13 November 2026; Sections 3 to 5, Section 6(1)–(8),(10), Sections 7 to 17, Section 27 except (1)(d), Sections 28 to 34, Sections 36 to 37 and Section 44(2) for 13 May 2027. A generic whole-section date is not authority to erase a mixed commencement (COMM:49–59[5]).

Rules 1,2,17–21 commence on publication, 13 November 2025; Rule 4 one year later; Rules 3,5–16,22,23 eighteen months later. The printed Gazette date controls this retained baseline, not an upload code. A designation-dependent duty can have a scheduled commencement but remain inapplicable to an undesignated entity. Conversely, an institution can be legally established without proof that named members were appointed or a receiving channel operates.

All following table summaries are author paraphrases with statutory commencement baselines. The exact factor quotation is separately labelled. Chapter references are navigation to the book’s intended operating discussion, not an assertion that every downstream chapter has completed remediation.

A.2 Act sections 1–44

A.3 Decision-critical subrows: registration, grounds and exemptions

Section 6(9) concerns every Consent Manager registering with the Board. Section 6(10) separately places notice/consent proof on the fiduciary when questioned in a proceeding. Neither is an SDF-only consent-record provision. Section 7 is (a)–(i), not an invented subsection list; exact clauses and rejection examples are in Chapter 3. Corporate restructuring belongs in conditioned Section 17(1)(e).

A.4 General-obligation and SDF anatomy

The following is a more operational dissection, not additional statutory wording. Each limb resolves to ACT-8 or ACT-10 and its exact passage in the canonical register.

These clauses direct the fiduciary; processor performance is supported through applicable contracts/law rather than changing Section 8(2)/(7)(b) into direct statutory processor wording. A new contract cannot transform independent vendor purpose-setting into on-behalf processing. The Company remains not_designated; a voluntary privacy owner is not automatically the statutory SDF DPO.

A.5 Rules 1–23

The English operative text has been read with GSR 892(E); numerical clocks below are not secondary-source rumours or deferred reader homework.

A.6 All seven Rules schedules

The First Schedule’s CM records retain notices, grants/refusals/withdrawals and sharing records for at least seven years or longer by agreement/law; the data shared through the platform must not be readable by the CM. These obligations concern registered CMs, not every enterprise consent software product. Read the nine eligibility items and thirteen obligations in the retained passage before vendor acceptance.

The Third Schedule is a class/purpose/period test, not a blanket three-year retention rule for all companies. Its listed e-commerce and social-media thresholds are two crore registered users in India, and online gaming fifty lakh; the three-year inactivity period uses the latest specified approach/rights event or Rules commencement, with account-access/token purposes excluded as written. Rule 8(3)‘s separate minimum one-year processing-record layer is not limited to those threshold classes. Rule 6(1)(e) separately concerns security data/logs; purpose, retention and permitted use need separate decisions (RULES:1142–1166,1598–1680[4]).

Fourth Schedule relief under Rule 12 concerns Section 9(1),(3), not the Section 9(2) detrimental-effect prohibition. Its classes and purposes are conditional, not a broad health/education/parent-token licence. Fifth and Sixth Schedules concern Board personnel, not data-principal services. The Seventh Schedule concerns Rule 23(1) and Rule 8(3), including specified State uses and SDF assessment with corresponding authorised persons. Nomination is Section 14/Rule 14(4); it has no separate schedule. These distinctions prevent a display-heading error from becoming an unsafe operating rule.

A.7 Penalties and exact factors

Source: ACT-SCHEDULE — research/legal/evidence/01_dpdp_act_2023_gazette.txt:1010–1045; Section 33 process/factors apply.

Source: ACT:836–846[3]. These are not weighted model coefficients.

No factor introduces a fixed intention/knowledge multiplier or generic catch-all aggravation category. No additive ₹450-crore cap is certified here. Section 33 requires a significant-breach determination after inquiry and hearing before a discretionary scheduled monetary penalty. Sections 34 and 42 separately address destination of penalty sums and notification-based Schedule amendment. Chapter 6 keeps assumed operational cost apart from unpredicted statutory awards.

Section 38(1) provides additional compatible application; Section 38(2) makes DPDP prevail to the extent of an actual conflict. Section 16(2) separately preserves higher Indian-law transfer protection/restrictions, not a universal strictest-law hierarchy (ACT:887–892,515–522[3]).

A.8 Notifications, composition and correction history

GSR 845(E) specifies composition, not appointments. Its four-member wording and the recruitment notice’s Chairperson-plus-four wording are preserved as an unresolved evidence discrepancy, not silently reconciled. Section 36 is a deferred Central Government power. Neither institution establishment nor recruitment proves retroactive applicability of core obligations, a staffed portal or successful filing.

GSR 892(E) is dated 10 December 2025, in the Gazette issue of 11 December. It replaces publication wording in Rule 1, “Department” with “Departments” in Rule 13(5), “given in such” with “given in such order” in Rule 23(1), “everybody” with “every body” and “18 or 2013” with “18 of 2013” in the First Schedule, and corrects punctuation/definition lettering to (a)–(g) in the Fourth Schedule. The page-38 correction is not a First Schedule definition correction. No new breach clock or nomination schedule results (CORR:24–38[8]).

A.9 Statutory outputs versus recommended artifact content

A.10 Evidence questions and update boundaries

A recommended audit asks for the ground and actual scope; what notice was served; the grant and later withdrawal; the required output and actual response; what retained copies may still do; and which tests support a claimed control. These questions are not predictions of exactly what a future Board inquiry will ask. A signed plan is not a run result, a processor acknowledgement is a supplier assertion, and a local fixture is not production evidence. Preserve failures and unknown sets rather than turning every row green.

Rule 7’s clocks/content, Rule 8’s periods, Rule 13’s cadence, Rule 14’s mechanism, verification routes, all schedules and the corrigendum are now source-checked. Remaining questions are the canonical UNRESOLVED_LEGAL_QUESTIONS.md: retention/copy/reset interpretation, role/application boundaries, actual Board evidence, bounded official-update coverage, early CM enforcement and penalty aggregation among them. An unsuccessful full eGazette search is not proof that no later order exists; no designation, restricted destination or appointment is inferred from silence.

Maintain the register by recording the exact new instrument, publication/effective dates, affected row and independent review status; regenerate this appendix and Chapter 2 together. Keep legal-source closure separate from entity deployment acceptance. The source monitoring cadence and named backup reviewer are author controls, not additional statutory clocks. A source change can require a control change, but neither a regenerated table nor a passing checksum proves the implementation changed.

For CASE-001, this appendix is a reference for the stopped training and vendor-reuse branches, isolated foreign backup, separate withdrawal/retention decisions and incomplete incident-delivery evidence. The full dossier remains owned by later phases. Appendix A does not substitute for promised appendices B–I, an assembled reader export or independent book acceptance; those gates remain outside Q02.

Source key and provenance legend

Physical references use newline-based line numbers in the following retained source paths; each numbered reference resolves to its original source URL. Review date: 15 September 2026. Full calculated hashes and source versions: out/remediation/Q02/source-manifest.json. The Q01 baseline and its bounded official-update limitations remain controlling; no later-law absence or entity certification is asserted.

• ACT: research/legal/evidence/01_dpdp_act_2023_gazette.txt — Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023).[3]
• RULES: research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E).[4]
• COMM: research/legal/evidence/02_gsr_843e_commencement.txt — G.S.R. 843(E), DPDP Act commencement notification.[5]
• EST: research/legal/evidence/03_gsr_844e_board_establishment.txt — G.S.R. 844(E), establishment of Data Protection Board of India.[6]
• MEMBERS: research/legal/evidence/04_gsr_845e_board_members.txt — G.S.R. 845(E), number of members of Data Protection Board of India.[7]
• CORR: research/legal/evidence/06_gsr_892e_corrigendum.txt — Corrigenda to G.S.R. 846(E), G.S.R. 892(E).[8]
• RECRUIT: research/legal/evidence/07_board_recruitment_notice_2026.txt — Filling up the post of Chairman & Members in the Data Protection Board of India.[9]

Sources

[3] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf [4] https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf [5] https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf [6] https://www.meity.gov.in/static/uploads/2025/11/cc217843dc3bcb37b2b05bcc3b4e031f.pdf [7] https://www.meity.gov.in/static/uploads/2025/11/f6c0837972422cf79d890bfe84cc04d6.pdf [8] https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf [9] https://www.meity.gov.in/static/uploads/2026/05/53b1bcf01cab9a0adde463e73fbc3417.pdf

Contents · Reader guide and citation conventions · Artifact index