Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

DPDP Act 2023 · Section 11

Right to access information about personal data

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) · Gazette page 9
Last verified
17 August 2026

What section 11 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 29 October 2026 against the MeitY library and India Code.

A Data Principal who gave consent, or volunteered data under certain legitimate uses, can ask the Data Fiduciary for a summary of her personal data and processing activities, the identities of Data Fiduciaries and Data Processors the data was shared with, and other prescribed information. An exception covers sharing authorised by law for offence or cyber incident purposes.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The notification states a period rather than a calendar date and does not state how the period is counted. The eGazette record of this same issue carries a code embedding 14112025, which would move the computed date by 1 day. Taken with the unstated counting, the 2 uncertainties together could move it by up to 2 days, to 15 May 2027 at the latest; the printed masthead date is used, and the interpretation label carries both uncertainties. CORRECTED 2026-08-25: this note previously also cited the Government's own PIB release for 14 November 2025. That release is about the DPDP Rules, 2025, G.S.R. 846(E) in Gazette issue No. 760, and says nothing about this Act commencement notification, G.S.R. 843(E) in issue No. 757. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer. A MeitY press release of 16 May 2026 (PRID 2261823) reports the Secretary, MeitY, as noting that the Act becomes fully enforceable from 13 May 2027; it is reported speech in a press release and not an instrument, so it corroborates this computation and does not confirm it, and the date basis stays derived.

Official text of section 11

Official requirement · verbatim

Section 11. Right to access information about personal data.(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,— (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed. (2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.

Commencement basis · Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act

“(c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.”

From commencement notification G.S.R. 843(E), Gazette issue No. 757, printed date 13 November 2025.

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11, p. 9. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedSection 11 begins on Gazette page 9 and concludes on page 10.
  2. [2]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own termsNotification G.S.R. 843(E) names this section in the group that comes into force eighteen months from the date of publication of the notification gazette. The computed calendar date, 13 May 2027, is interpretation until officially confirmed.
  3. [3]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 17 August 2026Document status: published; in effect per its own termsThe calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.
  5. [5]
    “National Consultative Workshop on ‘Strengthening Cyber Security Frameworks for State Data’” (Press Information Bureau release, PRID 2261823) (Release ID 2261823), p. 1. Published 16 May 2026. Official source ↗ · An official record, not a legal requirement · Verified 18 October 2026Document status: published official press release of 16 May 2026 on a MeitY workshop of 11 May 2026; it reports the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027; a press release and not an instrument, it cites no provision and no publication dateA press release of 16 May 2026 reporting the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027: the only official statement this site has located, as at 18 October 2026, that names the date this group computes to. Not an instrument and not a confirmation; the period in paragraph (c) is what the notification states.