(1) The Central Government may, by notification, make rules for carrying out the provisions of this Act.

(2) In particular, and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—

1. the manner and purposes for which the Data Principal may be provided subsidy, benefit, service, certificate, licence or permit under clause (b) of section 7;
2. the form and manner for giving intimation of personal data breach under sub-section (6) of section 8;
3. the manner of obtaining verifiable consent under sub-section (1) of section 9;
4. the classes of Data Fiduciaries and purposes to which the provisions of sub-sections (1) and (3) of section 9 shall not apply, and conditions therefor under sub-section (4) of section 9;
5. the measures to be undertaken by a Significant Data Fiduciary under sub-clause (iii) of clause (c) of sub-section (2) of section 10;
6. the other information which may be obtained by a Data Principal under clause (c) of sub-section (1) of section 11;
7. the manner of making a request for erasure under sub-section (3) of section 12;
8. the period within which the Data Fiduciary or Consent Manager shall respond to grievances under sub-section (2) of section 13;
9. the manner in which a Data Principal may nominate under sub-section (1) of section 14;
10. the standards for research, archiving or statistical purposes under clause (b) of sub-section (2) of section 17;
11. the manner of appointment of the Chairperson and other Members under sub-section (2) of section 19;
12. the salary, allowances and other terms and conditions of service of the Chairperson and other Members under sub-section (1) of section 20;
13. the procedure to be observed by the Board under sub-section (1) of section 23;
14. the terms and conditions of appointment and service of officers and employees under section 24;
15. the techno-legal measures to be adopted by the Board under sub-section (1) of section 28;
16. the procedure to be followed by the Board while conducting an inquiry under sub-section (3) of section 28;
17. the form and fee for filing an appeal under sub-section (2) of section 29;
18. the manner and mechanism for alternate dispute resolution under section 31;
19. the manner of obligations of Consent Manager under sub-section (7) of section 6;
20. the manner, technical, operational, financial and other conditions for registration of Consent Manager under sub-section (8) of section 6; and
21. any other matter which is to be, or may be, prescribed, or in respect of which provision is to be, or may be, made by rules.