The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed. What is in force today
Sources last verified on 23 September 2026. Methodology
Tag
5 articles on this site carry this tag. Open any of them for the source documents behind their legal claims, with a claim type label on every source.
Roles
The DPDP framework never addresses a Data Processor by name. What reaches you anyway, what binds you today and is not DPDP at all, and the 2 statutory duties on your customer that pull against each other.
Vendors
The DPDP Act prescribes little about a DPA, and none of that little is in force: a contract, Rule 6(1)(f) safeguards, erasure, from a computed 13 May 2027. Every other clause is drafting the statute never asks for, and that date is interpretation until officially confirmed.
Roles
One test decides it: who determines the purpose and means of the processing. The 8 engagements worked through, why one company holds both roles at once, what the test never asks, and why the Act says Fiduciary where other laws say controller.
Applicability
Usually yes, in 2 roles at once. For your own users you are a Data Fiduciary with the full duty set. For customer data you are a Data Processor, and the framework never addresses you by that name.
Vendors
Once section 8(2) and Rule 6 are in force, a Data Processor may be engaged only under a valid contract, and that contract must carry safeguard provisions. The 2 anchors, and what to add.
Each page carries the official text of the provision, its commencement status and the sources behind it.
Free, no login, and each one shows the provisions its answers rest on.
