Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Concept

Data Processor

Any person, including a company, firm or individual, that processes personal data on behalf of a Data Fiduciary. Section 8(2) allows a fiduciary to engage a processor only under a valid contract, and section 4(1) lets a person process personal data only in accordance with the Act and for a lawful purpose. Sections 4 and 8(2) commence on 13 May 2027, a date computed from the notification, so treat that date as interpretation until officially confirmed.

Official requirement · verbatim

“Data Processor” means any person who processes personal data on behalf of a Data Fiduciary

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Section 2(i) defines the Data Fiduciary as the person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. Both definitions have been in force since 13 November 2025 and impose no duty on their own.

Plain English

Section 8 names the Data Processor in several of the Data Fiduciary's own duties. Under section 8(1) the Data Fiduciary is responsible for complying with the Act and the rules in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under the Act. Under section 8(2) it may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract. Under section 8(5) it must protect personal data in its possession or under its control, including in respect of any processing undertaken on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. Rule 6(1) sets the minimum safeguards for that duty, and 2 of them name the processor: Rule 6(1)(b), appropriate measures to control access to the computer resources used by the Data Fiduciary or the Data Processor, wherever applicable, and Rule 6(1)(f), an appropriate provision in the contract between the Data Fiduciary and the Data Processor, wherever applicable, for taking reasonable security safeguards. Section 8 commences on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 6 on the same date, computed from Rule 1(4) and the publication of the Rules on 13 November 2025, so treat both dates as interpretation until officially confirmed.

Plain English

3 more provisions of the Act name the Data Fiduciary's processors, and Rule 8(3) adds a duty that does too. Under section 6(6), when a Data Principal withdraws her consent, the Data Fiduciary must within a reasonable time cease, and cause its Data Processors to cease, processing her personal data, unless processing without her consent is required or authorised under the Act, the rules or any other law in force in India. Under section 8(7), unless retention is necessary for compliance with any law in force, it must erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and cause its Data Processor to erase any personal data it made available to that processor. Under section 11(1)(b), a Data Principal who has previously given consent to a Data Fiduciary, including consent as referred to in section 7(a), may on a request made in the prescribed manner obtain the identities of all other Data Fiduciaries and Data Processors with whom it has shared her personal data, with a description of the data shared; under section 11(2) this does not apply to sharing with another Data Fiduciary authorised by law to obtain the data, on its written request for the prevention, detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences. Under Rule 8(3), without prejudice to Rules 8(1) and 8(2), the Data Fiduciary must retain, in respect of any processing undertaken by it or on its behalf by a Data Processor, the personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of processing, for the purposes specified in the Seventh Schedule, and then cause them to be erased unless further retention is required for compliance with any other law in force or notified by the Government. Sections 6(6), 7, 8 and 11 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 8 on the same date, computed from Rule 1(4), so treat both dates as interpretation until officially confirmed.

Plain English

Section 17 can switch off the duties in the Act described above. Section 17(1) disapplies Chapter II, except sections 8(1) and 8(5), together with Chapter III and section 16, in the cases it lists. One of them, in section 17(1)(d), is processing of the personal data of Data Principals not within the territory of India, by a person based in India, pursuant to a contract entered into with a person outside the territory of India; in that case sections 6(6), 8(2), 8(7) and 11 do not apply, while sections 8(1) and 8(5) still do. Section 17(2) disapplies the whole Act for processing by a notified instrumentality of the State in the listed interests, together with processing by the Central Government of personal data that instrumentality furnishes to it, and for processing necessary for research, archiving or statistical purposes on the conditions it sets. Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify Data Fiduciaries or classes, including startups, to whom sections 8(7) and 11, among other provisions, shall not apply. Section 17(4) disapplies section 8(7), among other provisions, for processing by the State or any instrumentality of the State. Section 17(5) lets the Central Government declare, before the expiry of 5 years from the date of commencement of the Act, that any provision of the Act shall not apply to a Data Fiduciary or class for a specified period. Section 6(9) commences on 13 November 2026. Sections 4, 5, 6(1) to 6(8), 6(10) and 7 to 17 commence on 13 May 2027. Both dates are computed from the commencement notification, so treat them as interpretation until officially confirmed.

Interpretation requires judgment

Read together, sections 8(1) and 8(2) keep responsibility for processing done on the Data Fiduciary's behalf with the Data Fiduciary, and an agreement to the contrary does not move it. Most of the duties in sections 5 to 10 are addressed to the Data Fiduciary, so in practice much of what a Data Processor does for a fiduciary will be set by its contract: Rule 6(1)(f) expects an appropriate security provision in that contract wherever applicable, and the contract is a natural place to record how the processor will cease processing under section 6(6) and erase data under section 8(7)(b), although neither section says the instruction must be contractual. The contract is not the only source of a processor's obligations: section 4(1) says a person may process the personal data of a Data Principal only in accordance with the Act and for a lawful purpose, and section 33(1) allows the Board to impose a penalty where it determines that a breach of the Act or the rules by a person is significant. How the Board will apply these provisions to a Data Processor is not settled by the text. Sections 4, 5, 6(1) to 6(8), 6(10), 7 to 10 and 33 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 6 on the same date, computed from Rule 1(4); section 6(9) commences on 13 November 2026, computed from paragraph (b); treat both dates as interpretation until officially confirmed.

Related tool

Role and Actor Checker

Work out your likely role for a processing activity, such as Data Fiduciary or Data Processor.

Open

Related tool

Vendor and Processor Checklist

Identify DPDP relevant actions for your vendors and Data Processors.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    any person who processes personal data on behalf of a Data Fiduciary
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    irrespective of any agreement to the contrary
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in respect of any processing undertaken by it or on its behalf by a Data Processor
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(5), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach
  9. [9]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(f), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor, wherever applicable, for taking reasonable security safeguards
  10. [10]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026
  11. [11]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    or failure of a Data Principal to carry out the duties provided under this Act
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    may engage, appoint, use or otherwise involve a Data Processor
  14. [14]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    which shall include, at the minimum
  15. [15]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    appropriate measures to control access to the computer resources used by such Data Fiduciary or such a Data Processor, wherever applicable
  16. [16]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), notification heading, p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; text subject to corrigendum G.S.R. 892(E)
    New Delhi, the 13th November, 2025
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(6), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    unless retention is necessary for compliance with any law for the time being in force
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier
  21. [21]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    to whom she has previously given consent, including consent as referred to in clause
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    upon making to it a request in such manner as may be prescribed
  24. [24]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary
  25. [25]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(2), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant
  26. [26]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(2), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences
  27. [27]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (3), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing
  28. [28]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (3), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government
  29. [29]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of Chapter II, except sub-sections
  30. [30]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    and those of Chapter III and section 16 shall not apply where
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1)(d), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India
  32. [32]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter II, p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
    CHAPTER II OBLIGATIONS OF DATA FIDUCIARY
  34. [34]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter III, p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
    as may be prescribed. CHAPTER III RIGHTS AND DUTIES OF DATA PRINCIPAL
  35. [35]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of this Act shall not apply in respect of the processing of personal data
  36. [36]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the processing by the Central Government of any personal data that such instrumentality may furnish to it
  37. [37]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal
  38. [38]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    having regard to the volume and nature of personal data processed
  39. [39]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply
  40. [40]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(4), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    In respect of processing by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8
  41. [41]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification
  42. [42]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    only under a valid contract
  43. [43]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(f), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor
  44. [44]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 4(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose
  45. [45]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 16. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    breach of the provisions of this Act or the rules made thereunder by a person is significant
  46. [46]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(6), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    cease and cause its Data Processors to cease processing
  47. [47]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    cause its Data Processor to erase any personal data