Chapter 1: Preliminary

Definitions, application, and commencement

chapter · 2 min read · Updated 14-Feb-2026 · 1 of 14

Executive Summary

•This section sets the stage. It defines exactly who is playing the game (Data Fiduciaries, Principals) and what the game is about (Digital Personal Data). If you aren't handling digital personal data, you can stop reading (but you almost certainly are).

•Know Your Role: Are you a Data Fiduciary (deciding why and how data is processed) or a Data Processor (doing it for someone else)? The buck stops with the Fiduciary.
•Scope Check: This applies to data collected digitally OR collected offline and then digitized. It applies to processing in India and outside India (if offering goods/services to India).
•Action Item: Create a data inventory. You can't protect what you haven't defined.

•You are the "Data Principal": The center of this universe.
•Scope: Your data is protected regardless of whether it was collected online or offline (if later digitized).

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A company maps the personal data it collects and records why it needs each category.

Incorrect

×A company collects offline forms, digitizes them, and assumes the rules do not apply.

This chapter establishes the foundational definitions and scope for the DPDP Act and Rules.

Short title and commencement: The Rules use phased commencement rather than one universal effective date.
Definitions: Most core terms come from section 2 of the Act; rule 2 adds terms used specifically in the Rules.
Application: Section 3 sets the Act's territorial and material scope.

Primary sources: DPDP Act, 2023 and DPDP Rules, 2025. Check the MeitY Rules page for corrigenda and later notifications.