Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Concept

Digital personal data

Personal data on computers, phones or servers, including data collected on paper and digitised later.

Official requirement · verbatim

“digital personal data” means personal data in digital form

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

The definition is built on 2 others. Section 2(h) defines data as a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means; section 2(t) makes data personal data when it is about an individual who is identifiable by or in relation to it; and section 2(n) keeps only the personal data that is in digital form. Section 2 has been in force since 13 November 2025 under paragraph (a) of the commencement notification, and a definition imposes no duty on its own.

Plain English

Data collected on paper comes in once it is digitised. Section 3(a) applies the Act, subject to the provisions of the Act, to the processing within India of digital personal data where the personal data is collected in digital form, or collected in a form that is not digital and digitised subsequently, so a paper form scanned or keyed into a system is digital personal data from then on. Section 7(b), which lets the State and any of its instrumentalities process personal data to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, uses the same pairing in clause (ii) for personal data available in digital form in, or digitised from, a database, register, book or other document maintained by the State or any of its instrumentalities and notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data. Sections 3 and 7 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

Personal data that stays on paper and is never digitised is outside the Act on this reading. Section 3(a) applies the Act to the processing of digital personal data, and section 2(x) defines processing as a wholly or partly automated operation or set of operations performed on digital personal data, so a paper file that is never digitised falls outside both. The test for whether the Act applies is the form of the data, not its sensitivity: section 2 creates no category of sensitive personal data, although section 10(1)(a) lists the volume and sensitivity of personal data processed among the relevant factors on whose assessment the Central Government may notify a Data Fiduciary as a Significant Data Fiduciary. Sections 3 and 10 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Applicability Checker

Find out whether the DPDP framework likely applies to your organisation and processing.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(n), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(h), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    any data about an individual who is identifiable by or in relation to such data
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    the provisions of sub-section (2) of section 1, section 2
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    apply to the processing of digital personal data within the territory of India where the personal data is collected
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in non-digital form and digitised subsequently
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b)(ii), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    such personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document
  8. [8]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3, p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Subject to the provisions of this Act, it shall
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed
  11. [11]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b)(ii), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    apply to the processing of digital personal data within the territory of India
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    means a wholly or partly automated operation or set of operations performed on digital personal data
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2, p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    In this Act, unless the context otherwise requires
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    on the basis of an assessment of such relevant factors as it may determine, including
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the volume and sensitivity of personal data processed