40. (1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.
(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:ΓÇö
(a) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5;
...
(f) the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8;
...
(z) any other matter which is to be or may be prescribed or in respect of which provision is to be, or may be, made by rules.