Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Concept

Specified purpose

The purpose named in the notice. Consent covers only the data necessary for it under section 6(1), and once the purpose is no longer served, section 8(7) requires erasure unless a law requires retention. Both duties commence on 13 May 2027, a date computed from the notification, so treat it as interpretation until officially confirmed. The definition in section 2 is in force.

Official requirement · verbatim

“specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder

Read section 2 of the Act, where this term is defined →Rule 3 of the DPDP Rules 2025 →Rule 8 of the DPDP Rules 2025 →

What the definition covers

Plain English

The definition ties the purpose to the notice. Section 5(1) requires every request made to a Data Principal under section 6 for consent to be accompanied or preceded by a notice given by the Data Fiduciary, informing her of the personal data and the purpose for which it is proposed to be processed, together with the other items section 5(1) lists, in such manner and as may be prescribed. Rule 3(b) requires the notice to give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, including at the minimum an itemised description of the personal data and the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, the processing. Section 5 and sections 6(1) to 6(8) and 6(10) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 3 on the same date under Rule 1(4); section 6(9) commences on 13 November 2026 under paragraph (b). Both dates are computed, so treat them as interpretation until officially confirmed.

Plain English

The purpose then limits what may be done. Section 6(1) requires consent to signify an agreement to the processing of personal data for the specified purpose and to be limited to such personal data as is necessary for it; its illustration limits consent given to a telemedicine app to the telemedicine service, because the phone contact list is not necessary for that service. Section 7(a) allows processing for the specified purpose for which the Data Principal has voluntarily provided her personal data, where she has not indicated that she does not consent to its use. Section 12(3) requires a Data Fiduciary, on a request for erasure made in the prescribed manner, to erase the personal data unless retention is necessary for the specified purpose or for compliance with any law for the time being in force, and section 15(b) requires a Data Principal not to impersonate another person while providing her personal data for a specified purpose. Sections 6(1), 7, 12 and 15 commence on 13 May 2027 under paragraph (c) of the commencement notification, a computed date, so treat it as interpretation until officially confirmed.

Plain English

The end of the purpose starts erasure. Section 8(7) requires a Data Fiduciary, unless retention is necessary for compliance with any law for the time being in force, to erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and to cause its Data Processor to erase any personal data made available to it for processing. Section 8(8) deems the purpose no longer served if the Data Principal neither approaches the Data Fiduciary for the performance of the specified purpose nor exercises any of her rights in relation to the processing for the time period prescribed, and section 8(11) treats her as not having approached it in any period during which she has not initiated contact for that performance, in person or by way of communication in electronic or physical form. Rule 8(1) and the Third Schedule prescribe that period for the classes of Data Fiduciaries and corresponding purposes the Schedule lists, again unless retention is necessary for compliance with any law, and Rule 8(2) requires the Data Fiduciary to inform the Data Principal at least 48 hours before the period ends that the data will be erased unless she logs into her user account or otherwise initiates contact for the performance of the specified purpose or exercises her rights in relation to the processing of that data. Sections 8(7), 8(8) and 8(11) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 8 on the same date under Rule 1(4); the date is computed, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

For a Data Fiduciary outside the classes the Third Schedule lists, or a Data Fiduciary in a listed class processing for a purpose outside the corresponding purposes listed for that class, no period has been prescribed, so on the Rules as notified the deeming in section 8(8) does not operate for it and the question is the one in section 8(7), whether it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with any law for the time being in force. A later change of plan does not move the specified purpose, because the definition fixes it as the purpose mentioned in the notice given in accordance with the Act and the Rules; where consent is the basis, a new purpose needs a new request for consent and the notice that goes with it under section 5(1). Sections 5, 8(7) and 8(8) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 8 on the same date under Rule 1(4); the date is computed, so treat it as interpretation until officially confirmed.

Related tool

Privacy Notice Checker

Check whether your notice covers the elements the DPDP sources require.

Open

Related tool

Retention and Erasure Planner

Identify DPDP retention and erasure triggers and the action steps for your context.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the personal data and the purpose for which the same is proposed to be processed
  4. [4]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent
  5. [5]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b)(i), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    an itemised description of such personal data
  6. [6]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b)(ii), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, such processing
  7. [7]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026
  8. [8]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Every request made to a Data Principal under section 6 for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in such manner and as may be prescribed
  11. [11]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    for the processing of her personal data, which shall include, at the minimum
  12. [12]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(1), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    for the specified purpose and be limited to such personal data as is necessary for such specified purpose
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(1), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    Since phone contact list is not necessary for making available telemedicine services
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 12(3), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 15(b), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    to ensure not to impersonate another person while providing her personal data for a specified purpose
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    unless retention is necessary for compliance with any law for the time being in force
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    erase personal data, upon the Data Principal withdrawing her consent or as
  21. [21]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    it is reasonable to assume that the specified purpose is no longer being served
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    shall be deemed to no longer be served, if the Data Principal does not
  24. [24]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(11), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in any period during which she has not initiated contact with the Data Fiduciary for such performance
  25. [25]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    if the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing
  26. [26]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (2), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose
  27. [27]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Time period for specified purpose to be deemed as no longer being served
  28. [28]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  29. [29]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    unless its retention is necessary for compliance with any law for the time being in force
  30. [30]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    approach the Data Fiduciary for the performance of the specified purpose
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    for such time period as may be prescribed
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    in accordance with the provisions of this Act and the rules made thereunder
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal