Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Significant Data Fiduciary

A Data Fiduciary, or class of them, that the Central Government notifies as significant under section 10(1). Extra duties include a Data Protection Officer based in India and responsible to the board of directors or similar governing body, an independent data auditor, and an impact assessment and audit once in every 12 months under Rule 13. None of these duties is in force yet: section 10 and Rule 13 commence on 13 May 2027, a date computed from the notifications, so treat it as interpretation until officially confirmed.

Official requirement · verbatim

“Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10

Read section 2 of the Act, where this term is defined →Rule 13 of the DPDP Rules 2025 →

What the definition covers

Plain English

Section 2(z) defines a Significant Data Fiduciary as any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10, so a Data Fiduciary has the status only when it is notified, or falls within a notified class. Section 10(1) lets the Central Government notify on the basis of an assessment of such relevant factors as it may determine, including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. Neither the Act nor the Rules name any Data Fiduciary or class as significant or set a numerical threshold for the status, so whether a particular company is one depends on a notification published in the Official Gazette. The definition has been in force since 13 November 2025; section 10 commences on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

Section 10(2) sets 3 groups of duties. First, appoint a Data Protection Officer who represents the Significant Data Fiduciary under the Act, is based in India, is an individual responsible to the Board of Directors or similar governing body, and is the point of contact for the grievance redressal mechanism. Second, appoint an independent data auditor to carry out data audit and evaluate its compliance with the Act. Third, undertake periodic Data Protection Impact Assessment, periodic data audit (the words since the Removal of Difficulties Order, S.O. 5458(E)) and such other measures, consistent with the Act, as may be prescribed. The Data Protection Impact Assessment is a process comprising a description of the rights of Data Principals and the purpose of processing their personal data, assessment and management of the risk to those rights, and such other matters as may be prescribed. These duties commence with section 10 on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

Rule 13 adds 4 duties. A Significant Data Fiduciary must, once in every period of 12 months from the date it is notified or included in a notified class, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the Act and the rules (Rule 13(1)); cause the person carrying them out to furnish to the Board a report containing significant observations in the assessment and audit (Rule 13(2)); observe due diligence to verify that technical measures, including algorithmic software, adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals (Rule 13(3)); and undertake measures to ensure that personal data specified by the Central Government, on the recommendations of a committee it constitutes, is processed subject to the restriction that the data and the traffic data pertaining to its flow is not transferred outside India (Rule 13(4)). Rule 13 commences 18 months after the publication of the Rules on 13 November 2025, on 13 May 2027, a date computed from Rule 1(4), so treat it as interpretation until officially confirmed.

Plain English

Item 4 of the Schedule, applied by section 33(1) where the Board determines on conclusion of an inquiry that a breach by a person is significant, sets the penalty for breach in observance of the additional obligations of a Significant Data Fiduciary under section 10 at an amount that may extend to 150 crore rupees. Section 10 is the last section of Chapter II, so section 17(1), which disapplies Chapter II except sections 8(1) and 8(5) in the cases it lists, reaches it. Section 17(2) disapplies the whole Act for processing by a notified instrumentality of the State in the listed interests, together with processing by the Central Government of personal data that instrumentality furnishes to it, and for processing necessary for research, archiving or statistical purposes on the conditions it sets. Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify Data Fiduciaries or classes, including startups, to whom section 10, among other provisions, shall not apply. Section 17(5) lets it declare, before the expiry of 5 years from the date of commencement of the Act, that any provision of the Act shall not apply to a Data Fiduciary or class for a specified period. Section 17(4) does not name section 10. Sections 8, 10, 17 and 33 commence on 13 May 2027, a date computed from paragraph (c) of the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Compliance Plan

Generate 1 company level action plan and see the work for your role first.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(z), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(z), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  5. [5]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(d), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  8. [8]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(e), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(1)(f), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
  12. [12]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(r), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
  14. [14]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(a), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(b), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  21. [21]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · Printed text, since modified by S.O. 5458(E); quoted as published · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  22. [22]
    Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), 2(ii), p. 3. Published 6 October 2026. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in force from the date of its publication in the Official Gazette
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 10(2)(c), p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  24. [24]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  25. [25]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (2), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  26. [26]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (3), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  27. [27]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (4), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  28. [28]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026In force since 13 November 2025
  29. [29]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 13, (1), p. 29. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  30. [30]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), notification heading, p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; text subject to corrigendum G.S.R. 892(E)
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  34. [34]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  35. [35]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  36. [36]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  37. [37]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  38. [38]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  39. [39]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  40. [40]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
  41. [41]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: published; in effect per its own terms
  42. [42]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 16. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  43. [43]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 33(1), p. 17. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  44. [44]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter II, p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  45. [45]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. Chapter III, p. 9. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Document status: official Gazette print on file; primary authority for Act text alongside the India Code entry
  46. [46]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  47. [47]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(3), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  48. [48]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(4), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 9 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed