Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Personal data

Any information about a person who can be identified by it or in relation to it: names, contact details, identifiers, records tied to a person.

Official requirement · verbatim

“personal data” means any data about an individual who is identifiable by or in relation to such data

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

The test is identifiability. Data is personal data when the individual it is about can be identified by it or in relation to it, so a record that carries no name can still qualify when it can be tied back to a person. Section 2 draws no line between ordinary and sensitive personal data: none of its 28 definitions creates a sensitive category. Sensitivity appears in the Act only as a factor the Central Government may weigh under section 10(1)(a) when notifying a Significant Data Fiduciary; section 10 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

The definition speaks of an individual, while section 2(s) uses the wider word person for companies, firms, the State and other bodies. Data about a company as such is therefore outside the definition, although data about the identifiable individuals who run it or work for it is inside it.

Plain English

The Act reaches less than the definition does. Section 3 applies it to the processing within India of digital personal data, whether collected in digital form or collected in a form that is not digital and digitised later, and to processing outside India in connection with any activity related to offering goods or services to Data Principals in India. It does not apply to personal data processed by an individual for any personal or domestic purpose, or to personal data made, or caused to be made, publicly available by the Data Principal it relates to or by any other person obliged under a law in force in India to make it publicly available. Section 3 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

Most of the duties built on the term sit in Chapter II, obligations of Data Fiduciary, sections 4 to 10, and Chapter III, rights and duties of Data Principal, sections 11 to 15; Chapter IV adds the power in section 16 to restrict transfers outside India and the exemptions in section 17. All of sections 4 to 17 commence on 13 May 2027 except section 6(9), which commences on 13 November 2026; both dates are computed from the commencement notification, so treat them as interpretation until officially confirmed. The definition itself has been in force since 13 November 2025 and imposes no duty on its own.

Related tool

Applicability Checker

Find out whether the DPDP framework likely applies to your organisation and processing.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2, p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  5. [5]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(s), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(b), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(c)(i), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  11. [11]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(c)(ii), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 16(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  16. [16]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
  17. [17]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms