Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

DPDP Rules 2025 · Rule 5

Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 25
Last verified
17 August 2026

What Rule 5 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 29 October 2026 against the MeitY library and India Code.

When the State or its instrumentalities process personal data to provide or issue a subsidy, benefit, service, certificate, licence or permit, they must follow the standards in the Second Schedule. The rule also explains what provision under law, under policy, or using public funds means for this purpose.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. Rule 1(4) states a period rather than a calendar date and does not state how the period is counted. The eGazette portal lists this document with a code embedding 14112025 and the Government's own PIB release states 14 November 2025, which would move the computed date by 1 day. Taken with the unstated counting, the 2 uncertainties together could move it by up to 2 days, to 15 May 2027 at the latest; the printed masthead date is used, and the interpretation label carries both uncertainties. The corrigendum wording change does not affect this computation. A MeitY press release of 16 May 2026 (PRID 2261823) reports the Secretary, MeitY, as noting that the Act becomes fully enforceable from 13 May 2027; it is reported speech in a press release and not an instrument, so it corroborates this computation and does not confirm it, and the date basis stays derived.

Official text of Rule 5

Official requirement · verbatim

Rule 5. Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities.(1) Processing the personal data of a Data Principal under this rule shall be done following the standards specified in Second Schedule. (2) In this rule and the Second Schedule, the reference to any subsidy, benefit, service, certificate, licence or permit that is provided or issued — (a) under law shall be construed as a reference to provision or issuance of such subsidy, benefit, service, certificate, licence or permit in exercise of any power of or the performance of any function by the State or any of its instrumentalities under any law for the time being in force; (b) under policy shall be construed as a reference to provision or issuance of such subsidy, benefit, service, certificate, licence or permit under any policy or instruction issued by the Central Government or a State Government in exercise of its executive power; and (c) using public funds shall be construed as a reference to provision or issuance of such subsidy, benefit, service, certificate, licence or permit by incurring expenditure on the same from, or with accrual of receipts to, — (i) in case of the Central Government or a State Government, the Consolidated Fund of India or the Consolidated Fund of the State or the public account of India or the public account of the State; or (ii) in case of any local or other authority within the territory of India or under the control of the Government of India or of any State, the fund or funds of such authority.

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 5, p. 25. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 17 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  2. [2]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Printed text, since corrected by G.S.R. 892(E); quoted as published · Verified 16 August 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
    As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  3. [3]
    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 16 August 2026Document status: published; text subject to corrigendum G.S.R. 892(E)The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.
  4. [4]
    “National Consultative Workshop on ‘Strengthening Cyber Security Frameworks for State Data’” (Press Information Bureau release, PRID 2261823) (Release ID 2261823), p. 1. Published 16 May 2026. Official source ↗ · An official record, not a legal requirement · Verified 18 October 2026Document status: published official press release of 16 May 2026 on a MeitY workshop of 11 May 2026; it reports the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027; a press release and not an instrument, it cites no provision and no publication dateA press release of 16 May 2026 reporting the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027: the only official statement this site has located, as at 18 October 2026, that names the date this group computes to. Not an instrument and not a confirmation; the period in Rule 1(4) is what the Rules state.