Legal Register
RULE-SCHEDULE-III Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Schedule III: r8(1) inactivity
No payments-vs-edtech period table; phased commencement anchor needs explicit interpretation.
Regulated Actor: Threshold-qualified e-commerce/gaming/social-media fiduciary
Gazette Baseline: Lines 1598–1680
Subordinate Trigger
r8(1) inactivity
Applies to: Threshold-qualified e-commerce/gaming/social-media fiduciary
Rule Prescriptions
E-commerce >=2 crore India registered users; gaming >=50 lakh; social >=2 crore; three years latest qualifying contact/rights event or Rules commencement; account/token-access purposes excluded.
Exceptions & Provisos
Definitions/excluded marketplace seller and r8 legal-retention qualification.
Official Gazette Text (Verbatim Rules Publication)
Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025.
THIRD SCHEDULE
[See rule 8(1)]
S. Class of Data
Purposes Time period
no. Fiduciaries
(1) (2) (3) (4)
1. Data Fiduciary who For all purposes, except for the following: Three years from the date on
is an e-commerce (a) Enabling the Data Principal to access which the Data Principal last
entity having not her user account; and approached the Data Fiduciary
less than two crore for the performance of the
(b) Enabling the Data Principal to access
registered users in specified purpose or exercise of
any virtual token that is issued by or
India. her rights, or the
on behalf of the Data Fiduciary, is
commencement of the Digital
stored on the digital facility or
Personal Data Protection Rules,
platform of such Data Fiduciary, and
2025, whichever is latest.
may be used to get money, goods or
services.
2. Data Fiduciary who For all purposes, except for the following: Three years from the date on
is an online gaming (a) Enabling the Data Principal to which the Data Principal last
intermediary having access her user account; and approached the Data Fiduciary
not less than fifty for the performance of the
(b) Enabling the Data Principal to
lakh registered users specified purpose or exercise of
access any virtual token that is
in India. her rights, or the
issued by or on behalf of the Data
commencement of the Digital
Fiduciary, is stored on the digital
Personal Data Protection Rules,
facility or platform of such Data
2025, whichever is latest.
36 THE GAZETTE OF INDIA : EXTRAORDINARY [PART II—SEC. 3(i)]
Fiduciary, and may be used to get
money, goods or services.
3. Data Fiduciary who For all purposes, except for the following: Three years from the date on
is a social media (a) Enabling the Data Principal to which the Data Principal last
intermediary having access her user account; and approached the Data Fiduciary
not less than two for the performance of the
(b) Enabling the Data Principal to
crore registered specified purpose or exercise of
access any virtual token that is
users in India. her rights, or the
issued by or on behalf of the Data
commencement of the Digital
Fiduciary, is stored on the digital
Personal Data Protection Rules,
facility or platform of such Data
2025, whichever is latest.
Fiduciary, and may be used to get
money, goods or services.
Note:In this Schedule, —
(a) “e-commerce entity” means any person who owns, operates or manages a digital facility or
platform for e-commerce as defined in the Consumer Protection Act, 2019 (35 of 2019), but does
not include a seller offering her goods or services for sale on a marketplace e-commerce entity as
defined in the said Act;
(b) “online gaming intermediary” means any intermediary who enables the users of its computer
resource to access one or more online games;
(c) “social media intermediary” means an intermediary as defined in clause (w) of sub-rule (1) of rule
2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules,
2021; and
(d) “user”, in relation to—
(i) an e-commerce entity, means any person who accesses or avails any computer resource of
an e-commerce entity; and
(ii) an online gaming intermediary or a social media intermediary, means any person who
accesses or avails of any computer resource of an intermediary for the purpose of hosting,
publishing, sharing, transacting, viewing, displaying, downloading or uploading
information.