Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Digital personal data

Personal data on computers, phones or servers, including data collected on paper and digitised later.

Official requirement · verbatim

“digital personal data” means personal data in digital form

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

The definition is built on 2 others. Section 2(h) defines data as a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means; section 2(t) makes data personal data when it is about an individual who is identifiable by or in relation to it; and section 2(n) keeps only the personal data that is in digital form. Section 2 has been in force since 13 November 2025 under paragraph (a) of the commencement notification, and a definition imposes no duty on its own.

Plain English

Data collected on paper comes in once it is digitised. Section 3(a) applies the Act, subject to the provisions of the Act, to the processing within India of digital personal data where the personal data is collected in digital form, or collected in a form that is not digital and digitised subsequently, so a paper form scanned or keyed into a system is digital personal data from then on. Section 7(b), which lets the State and any of its instrumentalities process personal data to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, uses the same pairing in clause (ii) for personal data available in digital form in, or digitised from, a database, register, book or other document maintained by the State or any of its instrumentalities and notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data. Sections 3 and 7 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

Personal data that stays on paper and is never digitised is outside the Act on this reading. Section 3(a) applies the Act to the processing of digital personal data, and section 2(x) defines processing as a wholly or partly automated operation or set of operations performed on digital personal data, so a paper file that is never digitised falls outside both. The test for whether the Act applies is the form of the data, not its sensitivity: section 2 creates no category of sensitive personal data, although section 10(1)(a) lists the volume and sensitivity of personal data processed among the relevant factors on whose assessment the Central Government may notify a Data Fiduciary as a Significant Data Fiduciary. Sections 3 and 10 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Applicability Checker

Find out whether the DPDP framework likely applies to your organisation and processing.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(n), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(h), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  4. [4]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b)(ii), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  8. [8]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3, p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  11. [11]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(b)(ii), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  12. [12]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  13. [13]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2, p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed