Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Data Processor

Any person, including a company, firm or individual, that processes personal data on behalf of a Data Fiduciary. Section 8(2) allows a fiduciary to engage a processor only under a valid contract, and section 4(1) lets a person process personal data only in accordance with the Act and for a lawful purpose. Sections 4 and 8(2) commence on 13 May 2027, a date computed from the notification, so treat that date as interpretation until officially confirmed.

Official requirement · verbatim

“Data Processor” means any person who processes personal data on behalf of a Data Fiduciary

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Section 2(i) defines the Data Fiduciary as the person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. Both definitions have been in force since 13 November 2025 and impose no duty on their own.

Plain English

Section 8 names the Data Processor in several of the Data Fiduciary's own duties. Under section 8(1) the Data Fiduciary is responsible for complying with the Act and the rules in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under the Act. Under section 8(2) it may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract. Under section 8(5) it must protect personal data in its possession or under its control, including in respect of any processing undertaken on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. Rule 6(1) sets the minimum safeguards for that duty, and 2 of them name the processor: Rule 6(1)(b), appropriate measures to control access to the computer resources used by the Data Fiduciary or the Data Processor, wherever applicable, and Rule 6(1)(f), an appropriate provision in the contract between the Data Fiduciary and the Data Processor, wherever applicable, for taking reasonable security safeguards. Section 8 commences on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 6 on the same date, computed from Rule 1(4) and the publication of the Rules on 13 November 2025, so treat both dates as interpretation until officially confirmed.

Plain English

3 more provisions of the Act name the Data Fiduciary's processors, and Rule 8(3) adds a duty that does too. Under section 6(6), when a Data Principal withdraws her consent, the Data Fiduciary must within a reasonable time cease, and cause its Data Processors to cease, processing her personal data, unless processing without her consent is required or authorised under the Act, the rules or any other law in force in India. Under section 8(7), unless retention is necessary for compliance with any law in force, it must erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and cause its Data Processor to erase any personal data it made available to that processor. Under section 11(1)(b), a Data Principal who has previously given consent to a Data Fiduciary, including consent as referred to in section 7(a), may on a request made in the prescribed manner obtain the identities of all other Data Fiduciaries and Data Processors with whom it has shared her personal data, with a description of the data shared; under section 11(2) this does not apply to sharing with another Data Fiduciary authorised by law to obtain the data, on its written request for the prevention, detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences. Under Rule 8(3), without prejudice to Rules 8(1) and 8(2), the Data Fiduciary must retain, in respect of any processing undertaken by it or on its behalf by a Data Processor, the personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of processing, for the purposes specified in the Seventh Schedule, and then cause them to be erased unless further retention is required for compliance with any other law in force or notified by the Government. Sections 6(6), 7, 8 and 11 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 8 on the same date, computed from Rule 1(4), so treat both dates as interpretation until officially confirmed.

Plain English

Section 17 can switch off the duties in the Act described above. Section 17(1) disapplies Chapter II, except sections 8(1) and 8(5), together with Chapter III and section 16, in the cases it lists. One of them, in section 17(1)(d), is processing of the personal data of Data Principals not within the territory of India, by a person based in India, pursuant to a contract entered into with a person outside the territory of India; in that case sections 6(6), 8(2), 8(7) and 11 do not apply, while sections 8(1) and 8(5) still do. Section 17(2) disapplies the whole Act for processing by a notified instrumentality of the State in the listed interests, together with processing by the Central Government of personal data that instrumentality furnishes to it, and for processing necessary for research, archiving or statistical purposes on the conditions it sets. Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify Data Fiduciaries or classes, including startups, to whom sections 8(7) and 11, among other provisions, shall not apply. Section 17(4) disapplies section 8(7), among other provisions, for processing by the State or any instrumentality of the State. Section 17(5) lets the Central Government declare, before the expiry of 5 years from the date of commencement of the Act, that any provision of the Act shall not apply to a Data Fiduciary or class for a specified period. Sections 6(6), 8, 11, 16 and 17 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

Read together, sections 8(1) and 8(2) keep responsibility for processing done on the Data Fiduciary's behalf with the Data Fiduciary, and an agreement to the contrary does not move it. Most of the duties in sections 5 to 10 are addressed to the Data Fiduciary, so in practice much of what a Data Processor does for a fiduciary will be set by its contract: Rule 6(1)(f) expects an appropriate security provision in that contract wherever applicable, and the contract is a natural place to record how the processor will cease processing under section 6(6) and erase data under section 8(7)(b), although neither section says the instruction must be contractual. The contract is not the only source of a processor's obligations: section 4(1) says a person may process the personal data of a Data Principal only in accordance with the Act and for a lawful purpose, and section 33(1) allows the Board to impose a penalty where it determines that a breach of the Act or the rules by a person is significant. How the Board will apply these provisions to a Data Processor is not settled by the text. Sections 4, 5, 6(1) to 6(8), 6(10), 7 to 10 and 33 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, and Rule 6 on the same date, computed from Rule 1(4); section 6(9) commences on 13 November 2026, computed from paragraph (b); treat both dates as interpretation until officially confirmed.

Related tool

Role and Actor Checker

Work out your likely role for a processing activity, such as Data Fiduciary or Data Processor.

Open

Related tool

Vendor and Processor Checklist

Identify DPDP relevant actions for your vendors and Data Processors.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(5), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  9. [9]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(f), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  12. [12]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(1), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  15. [15]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  16. [16]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  17. [17]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), notification heading, p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; text subject to corrigendum G.S.R. 892(E)
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(6), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  21. [21]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  23. [23]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  24. [24]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  25. [25]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  26. [26]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(1), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  27. [27]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  28. [28]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(2), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  29. [29]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11(2), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  30. [30]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (3), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  31. [31]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (3), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  34. [34]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1)(d), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  35. [35]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter II, p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  36. [36]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter III, p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  37. [37]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  38. [38]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  39. [39]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  40. [40]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  41. [41]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  42. [42]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(4), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  43. [43]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  44. [44]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(2), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  45. [45]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 6, (1)(f), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  46. [46]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 4(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  47. [47]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 16. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  48. [48]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(6), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  49. [49]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  50. [50]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  51. [51]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  52. [52]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms