Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Processing

Nearly anything done to digital personal data by automated means, from collection and storage through sharing to erasure.

Official requirement · verbatim

“processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction

Read section 2 of the Act, where this term is defined →

What the definition covers

Plain English

The definition has 3 elements: an operation or set of operations, wholly or partly automated, performed on digital personal data. Section 2(b) defines automated as any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data. The operations the definition then lists run from collection, recording, organisation, structuring and storage, through adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, to restriction, erasure or destruction. Section 2 has been in force since 13 November 2025 under paragraph (a) of the commencement notification.

Interpretation requires judgment

The list is introduced by the words "includes operations such as", so it gives examples and does not close the definition. Partly automated is enough, so a workflow on digital personal data that mixes manual steps with automated ones is processing. Storage, restriction, erasure and destruction are themselves listed, so keeping digital personal data and deleting it are processing as much as collecting or sharing it.

Plain English

The term decides who holds a role. Section 2(i) makes a Data Fiduciary any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, and section 2(k) makes a Data Processor any person who processes personal data on behalf of a Data Fiduciary. Section 4(1) allows a person to process the personal data of a Data Principal only in accordance with the provisions of the Act and for a lawful purpose for which the Data Principal has given her consent or for certain legitimate uses, and section 4(2) defines a lawful purpose as any purpose which is not expressly forbidden by law. Section 3(c)(i) takes personal data processed by an individual for any personal or domestic purpose outside the Act. Sections 3 and 4 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Applicability Checker

Find out whether the DPDP framework likely applies to your organisation and processing.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(b), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  5. [5]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(x), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(i), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(k), p. 2. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 4(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  11. [11]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 4(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  12. [12]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 4(2), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(c)(i), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  14. [14]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  15. [15]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms