THIRD Schedule

G.S.R. 846(E) In force 13 May 2027 · Rule 1 Penalty cap ₹50 cr

THIRD SCHEDULE [See rule 8(1)]

S. Class of Data Purposes Time period no. Fiduciaries

(1) (2) (3) (4)

1. Data Fiduciary who For all purposes, except for the following: Three years from the date on is an e-commerce (a) Enabling the Data Principal to access which the Data Principal last entity having not her user account; and approached the Data Fiduciary less than two crore for the performance of the

(b) Enabling the Data Principal to access registered users in specified purpose or exercise of any virtual token that is issued by or India. her rights, or the on behalf of the Data Fiduciary, is commencement of the Digital stored on the digital facility or Personal Data Protection Rules, platform of such Data Fiduciary, and 2025, whichever is latest. may be used to get money, goods or services.

2. Data Fiduciary who For all purposes, except for the following: Three years from the date on is an online gaming (a) Enabling the Data Principal to which the Data Principal last intermediary having access her user account; and approached the Data Fiduciary not less than fifty for the performance of the

(b) Enabling the Data Principal to lakh registered users specified purpose or exercise of access any virtual token that is in India. her rights, or the issued by or on behalf of the Data commencement of the Digital Fiduciary, is stored on the digital Personal Data Protection Rules, facility or platform of such Data 2025, whichever is latest.

Fiduciary, and may be used to get money, goods or services.

3. Data Fiduciary who For all purposes, except for the following: Three years from the date on is a social media (a) Enabling the Data Principal to which the Data Principal last intermediary having access her user account; and approached the Data Fiduciary not less than two for the performance of the

(b) Enabling the Data Principal to crore registered specified purpose or exercise of access any virtual token that is users in India. her rights, or the issued by or on behalf of the Data commencement of the Digital Fiduciary, is stored on the digital Personal Data Protection Rules, facility or platform of such Data 2025, whichever is latest. Fiduciary, and may be used to get money, goods or services.

Note:In this Schedule, —

(a) “e-commerce entity” means any person who owns, operates or manages a digital facility or platform for e-commerce as defined in the Consumer Protection Act, 2019 (35 of 2019), but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity as defined in the said Act;

(b) “online gaming intermediary” means any intermediary who enables the users of its computer resource to access one or more online games;

(c) “social media intermediary” means an intermediary as defined in clause (w) of sub-rule (1) of rule 2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and

(d) “user”, in relation to—

(i) an e-commerce entity, means any person who accesses or avails any computer resource of an e-commerce entity; and

(ii) an online gaming intermediary or a social media intermediary, means any person who accesses or avails of any computer resource of an intermediary for the purpose of hosting, publishing, sharing, transacting, viewing, displaying, downloading or uploading information.

Verbatim from the gazette. Cross-references in the text link to the section or rule they cite. Corrigendum G.S.R. 892(E) makes no change to this text.