Section 40: Power to make rules

Section 40 is the rule-making provision that gives the Central Government power to flesh out the Act's framework: Rules can cover: 1. Notice formats and procedures (Sections 5, 6) 2. Consent Manager accountability, obligations, and registration 3. Categories of government subsidies and benefits 4. Data breach intimation forms and formats 5. Time periods for data retention and purpose completion 6. Publication of Data Protection Officer contact details 7. Verifiable consent procedures for children 8. Exemptions for specific classes of Data Fiduciaries processing children's data 9. Data Protection Impact Assessment details 10. Procedures for Data Principals to request access, correction, or erasure 11. Grievance response timelines 12. Nomination procedures 13. Board appointment, salary, and authentication procedures 14. Techno-legal measures for Board functioning 15. Appeal forms, fees, and procedures These rules will provide the detailed operational framework for the Act.