Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Data Fiduciary

The organisation that decides why and how personal data is used. Most duties in the framework attach to this role.

Official requirement · verbatim

“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

The role turns on who decides. A Data Fiduciary determines the purpose and the means of processing personal data, alone or in conjunction with others, so two or more persons can each be a Data Fiduciary for the same processing. A person that only processes personal data on behalf of a Data Fiduciary is a Data Processor under section 2(k).

Interpretation requires judgment

The role is set by each processing activity, not by the organisation as a whole. A company is a Data Fiduciary for the customer and staff data it decides to collect, and can be a Data Processor for data it handles only on a client's instructions.

Plain English

Section 2(s) says person includes an individual, a Hindu undivided family, a company, a firm, an association of persons or a body of individuals whether incorporated or not, the State, and every other artificial juristic person. The list is inclusive rather than closed. The State, which section 2(zb) defines by reference to article 12 of the Constitution, or an individual running a business can therefore be a Data Fiduciary when it determines the purpose and means of processing personal data.

Plain English

Responsibility stays with the Data Fiduciary when it outsources. Section 8(1) makes it responsible for complying with the Act and the Rules for processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary, and section 8(2) lets it involve a Data Processor for activity related to offering goods or services to Data Principals only under a valid contract. Section 8 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

A Significant Data Fiduciary is a Data Fiduciary, or a class of them, that the Central Government notifies under section 10, which then attaches further duties. Section 10 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Role and Actor Checker

Work out your likely role for a processing activity, such as Data Fiduciary or Data Processor.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(s), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(zb), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
  11. [11]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(z), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed