Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Concept

Significant Data Fiduciary

A Data Fiduciary, or class of them, that the Central Government notifies as significant under section 10(1). Extra duties include a Data Protection Officer based in India and responsible to the board of directors or similar governing body, an independent data auditor, and an impact assessment and audit once in every 12 months under Rule 13. None of these duties is in force yet: section 10 and Rule 13 commence on 13 May 2027, a date computed from the notifications, so treat it as interpretation until officially confirmed.

Official requirement · verbatim

“Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10

Read section 2 of the Act, where this term is defined →Rule 13 of the DPDP Rules 2025 →

What the definition covers

Plain English

Section 2(z) defines a Significant Data Fiduciary as any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10, so a Data Fiduciary has the status only when it is notified, or falls within a notified class. Section 10(1) lets the Central Government notify on the basis of an assessment of such relevant factors as it may determine, including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. Neither the Act nor the Rules name any Data Fiduciary or class as significant or set a numerical threshold for the status, so whether a particular company is one depends on a notification published in the Official Gazette. The definition has been in force since 13 November 2025; section 10 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

Section 10(2) sets 3 groups of duties. First, appoint a Data Protection Officer who represents the Significant Data Fiduciary under the Act, is based in India, is an individual responsible to the Board of Directors or similar governing body, and is the point of contact for the grievance redressal mechanism. Second, appoint an independent data auditor to carry out data audit and evaluate its compliance with the Act. Third, undertake periodic Data Protection Impact Assessment, periodic data audit (the words since the Removal of Difficulties Order, S.O. 5458(E)) and such other measures, consistent with the Act, as may be prescribed. The Data Protection Impact Assessment is a process comprising a description of the rights of Data Principals and the purpose of processing their personal data, assessment and management of the risk to those rights, and such other matters as may be prescribed. These duties commence with section 10 on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

Rule 13 adds 4 duties. A Significant Data Fiduciary must, once in every period of 12 months from the date it is notified or included in a notified class, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and the rules (Rule 13(1)); cause the person carrying them out to furnish to the Board a report containing significant observations in the assessment and audit (Rule 13(2)); observe due diligence to verify that technical measures, including algorithmic software, adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals (Rule 13(3)); and undertake measures to ensure that personal data specified by the Central Government, on the recommendations of a committee it constitutes, is processed subject to the restriction that the data and the traffic data pertaining to its flow is not transferred outside India (Rule 13(4)). Rule 13 commences 18 months after the publication of the Rules on 13 November 2025, on 13 May 2027, a date computed from Rule 1(4), so treat it as interpretation until officially confirmed.

Plain English

Item 4 of the Schedule, applied by section 33(1) where the Board determines on conclusion of an inquiry that a breach by a person is significant, sets the penalty for breach in observance of the additional obligations of a Significant Data Fiduciary under section 10 at an amount that may extend to 150 crore rupees. Section 10 is the last section of Chapter II, so section 17(1), which disapplies Chapter II except sections 8(1) and 8(5) in the cases it lists, reaches it. Section 17(2) disapplies the whole Act for processing by a notified instrumentality of the State in the listed interests, together with processing by the Central Government of personal data that instrumentality furnishes to it, and for processing necessary for research, archiving or statistical purposes on the conditions it sets. Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify Data Fiduciaries or classes, including startups, to whom section 10, among other provisions, shall not apply. Section 17(5) lets it declare, before the expiry of 5 years from the date of commencement of the Act, that any provision of the Act shall not apply to a Data Fiduciary or class for a specified period. Section 17(4) does not name section 10. Section 6(9) commences on 13 November 2026. Sections 4, 5, 6(1) to 6(8), 6(10), 7 to 10, 17 and 33 commence on 13 May 2027. Both dates are computed from the commencement notification, so treat them as interpretation until officially confirmed.

Related tool

Compliance Plan

Generate 1 company level action plan and see the work for your role first.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(z), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(z), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
    any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    on the basis of an assessment of such relevant factors as it may determine, including
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the volume and sensitivity of personal data processed
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    risk to the rights of Data Principal
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    potential impact on the sovereignty and integrity of India
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(d), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    risk to electoral democracy
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(e), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    security of the State
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(f), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    public order
  10. [10]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
    the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(r), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
    a notification published in the Official Gazette
  13. [13]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    represent the Significant Data Fiduciary under the provisions of this Act
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    be based in India
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    be an individual responsible to the Board of Directors or similar governing body of the Significant Data Fiduciary
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    be the point of contact for the grievance redressal mechanism under the provisions of this Act
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    appoint an independent data auditor to carry out data audit, who shall evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    periodic Data Protection Impact Assessment, which shall be a process comprising a description of the rights of Data Principals and the purpose of processing of their personal data, assessment and management of the risk to the rights of the Data Principals, and such other matters regarding such process as may be prescribed
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · Printed text, since modified by S.O. 5458(E); quoted as published · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    periodic audit
  21. [21]
    Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), 2(ii), p. 3. Published 6 October 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in force from the date of its publication in the Official Gazette
    in section 10, in sub-section (2), in clause (c), in sub-clause (ii), for the word “audit”, the words “data audit” shall be substituted;
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    such other measures, consistent with the provisions of this Act, as may be prescribed
  23. [23]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit
  24. [24]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (2), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations
  25. [25]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (3), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals
  26. [26]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (4), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India
  27. [27]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication
  28. [28]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    to ensure effective observance of the provisions of this Act and the rules made thereunder
  29. [29]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), notification heading, p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; text subject to corrigendum G.S.R. 892(E)
    New Delhi, the 13th November, 2025
  30. [30]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Breach in observance of additional obligations of Significant Data Fiduciary under section 10.
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    May extend to one hundred and fifty crore rupees.
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of Chapter II, except sub-sections
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of this Act shall not apply in respect of the processing of personal data
  34. [34]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    by such instrumentality of the State as the Central Government may notify
  35. [35]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed
  36. [36]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    including startups, as Data Fiduciaries to whom the provisions of section 5
  37. [37]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    sections 10 and 11 shall not apply
  38. [38]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification
  39. [39]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
  40. [40]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 16. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant
  41. [41]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 17. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    impose such monetary penalty specified in the Schedule
  42. [42]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter II, p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
    CHAPTER II OBLIGATIONS OF DATA FIDUCIARY
  43. [43]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter III, p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
    as may be prescribed. CHAPTER III RIGHTS AND DUTIES OF DATA PRINCIPAL
  44. [44]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the processing by the Central Government of any personal data that such instrumentality may furnish to it
  45. [45]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    having regard to the volume and nature of personal data processed
  46. [46]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(4), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    In respect of processing by the State or any instrumentality of the State, the provisions of sub-section