Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

DPDP Rules 2025 · Rule 13

Additional obligations of Significant Data Fiduciary

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 29
Last verified
17 August 2026

What Rule 13 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 28 September 2026 against the MeitY library and India Code.

A Significant Data Fiduciary must undertake a Data Protection Impact Assessment and an audit once every 12 months, with significant observations reported to the Board. It must verify that technical measures, including algorithmic software, are not likely to pose risks to Data Principals' rights, and keep government specified personal data and its traffic data within India.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. The eGazette portal lists this document with a code embedding 14112025 and the Government's own PIB release states 14 November 2025, which would move the computed date by 1 day; the printed masthead date is used, and the interpretation label carries that uncertainty. The corrigendum wording change does not affect this computation.

Official text of Rule 13, as corrected by G.S.R. 892(E)

Corrected by corrigenda G.S.R. 892(E)

  • For “Department” read “Departments” (page 29, line 44)

The text below shows the corrected wording.

Official requirement · as corrected by G.S.R. 892(E)

Rule 13. Additional obligations of Significant Data Fiduciary.(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder. (2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit. (3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals. (4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India. (5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Departments of the Central Government.

Show the text as originally printed, before corrigendum

(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder. (2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit. (3) A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals. (4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India. (5) In this rule, “committee” means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Department of the Central Government.

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedThe printed text reads "Ministry of Electronics and Technology" in sub rule (5); the corrigendum does not correct that phrase, so it is reproduced as printed.
  2. [2]
    Corrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E)), (ii), p. 1. Published 11 December 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Pointer to the official correction, not a requirement · Verified 16 August 2026Document status: published; in effectCorrigendum item (ii) corrects "Department" to "Departments" at Gazette page 29 line 44.
  3. [3]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Printed text, since corrected by G.S.R. 892(E); quoted as published · Verified 16 August 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
    As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  4. [4]
    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 16 August 2026Document status: published; text subject to corrigendum G.S.R. 892(E)The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.
  5. [5]
    Corrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E)), (ii), p. 1. Published 11 December 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official correction to the printed text, quoted · Verified 16 August 2026Document status: published; in effect
    in page 29, line 44, for “Department”, read “Departments”