Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter I — Preliminary
DPDP Act, 2023 · Chapter I of IX

Chapter I: Preliminary

Chapter I is the Act's front door: it gives the law its name, explains how and when it switches on, defines the terms every other chapter relies on, and draws the outer boundary of who and what the Act covers.

Sections 1–3 · 3 sectionsAll 3 sections in forceReviewed September 2026
Back to the Full DPDP Act GuideChapter II — Obligations of Data Fiduciary
  1. 1Short Title and Commencement
  2. 2Definitions
  3. 3Application of Act

Chapter summary

In plain terms: Chapter I does not impose compliance duties by itself. It tells you whether the Act applies to you and how to read everything that follows — the commencement mechanism (Section 1), the 28 defined terms (Section 2) and the scope of the Act, including processing outside India and the matters it leaves out (Section 3).

How the sections fit together

Read Chapter I in order. Section 1 answers when the Act applies, because different parts switch on on different dates. Section 2 answers what the words mean. Section 3 answers to whom and to what the Act applies. Every later chapter assumes you have already settled those three questions.

In practice, scoping a DPDP programme follows a short sequence: is the information personal data, is it digital (or later digitised), who decides why and how it is processed, does the processing happen in India or connect to people in India, and does one of the Section 3 exclusions apply. Working through that list for each system and vendor gives you the real boundary of your obligations.

Sections at a glance

Sections 1–3 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 1Short Title and CommencementEnacted Aug 2023

Section 1 doesn't create any obligation for anyone — it names the Act and hands the Central Government the power to switch different parts of it on at different times, by notification.

Read the full explanation Sec. 2DefinitionsIn force

Section 2 is the Act's dictionary — 28 defined terms, from "automated" to "State," that every other section relies on.

Read the full explanation Sec. 3Application of ActIn force

Section 3 draws the outer boundary of the entire Act: what kind of data it covers, whose processing it reaches even outside India, and three specific situations it carves out entirely — personal or domestic use, and data the individual (or someone legally required to) has already made public.

Read the full explanation

Key terms in this chapter

Personal data
Any data about an individual who is identifiable by or in relation to that data.
Digital personal data
Personal data in digital form. Non-digital data that is digitised later is also covered.
Data Principal
The individual the data relates to. For a child, this includes the parent or lawful guardian; for a person with a disability, the lawful guardian.
Data Fiduciary
Any person who alone or together with others decides the purpose and means of processing personal data.
Data Processor
A person who processes personal data on behalf of a Data Fiduciary.
Consent Manager
A person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent.
Processing
A wholly or partly automated operation on digital personal data, from collection through to erasure.

Why this chapter matters

Every compliance question under the DPDP Act starts here. Whether an organisation is a “Data Fiduciary”, whether the information it holds is “digital personal data”, and whether a processing activity falls inside or outside the Act are all settled by these three sections. Getting the definitions wrong is the most common reason teams misjudge the scope of their DPDP programme.

Who needs to care about this chapter

  • Anyone starting a DPDP assessment — scoping the Act is always step one.
  • Foreign companies that offer goods or services to people in India and are unsure whether the Act reaches them.
  • Legal and compliance teams who need the Act's definitions (Data Fiduciary, Data Processor, Consent Manager, Significant Data Fiduciary and others) in one place.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • Run every dataset through the personal-data test and record the result.
  • Note which data is digital from the start and which is digitised later.
  • For each process, record who decides purpose and means (the Data Fiduciary) and who only acts on instructions (the Data Processor).
  • If you are outside India, check whether you offer goods or services to people in India.
  • Document any reliance on a Section 3 exclusion, with the reason.
  • Keep a dated map of which chapters apply from which date.

Common mistakes to avoid

  • Calling a vendor a Data Processor without checking who really decides why the data is used.
  • Assuming a head office outside India puts India-facing services outside the Act.
  • Treating all online data as exempt because it is “publicly available”. The exclusion covers only data the individual made public, or that someone made public under a legal obligation.
  • Planning for one go-live date when the Act is switching on in stages.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 1 — Short Title and Commencement

Read the Rule

Rule 2 — Definitions

Read the Rule

Common questions

Does the DPDP Act apply to companies outside India?
Yes, in one situation: when processing outside India is connected to offering goods or services to Data Principals within India. Section 3 sets this out. Outside that, processing of personal data that happens entirely abroad is not covered.
Does the Act cover paper records?
The Act applies to personal data collected in digital form, and to personal data collected in non-digital form that is digitised afterwards. Purely paper records that are never digitised fall outside it.
Is personal data that someone has posted publicly exempt?
Section 3 carves out personal data that the Data Principal herself has made public, or that someone else has made public under a legal obligation to do so. Personal or domestic use by an individual is also outside the Act.
What counts as personal data under the DPDP Act?
Any data about an individual who can be identified by or in relation to that data. A name, phone number, email address, account number or device identifier can each qualify, depending on whether it identifies a person in context.
What is the difference between a Data Fiduciary and a Data Processor?
The Data Fiduciary decides why and how personal data is processed and carries the Act's obligations. The Data Processor processes data on the fiduciary's behalf under a contract and does not decide purpose or means.
Do all parts of the Act apply from the same date?
No. Section 1 allows the Central Government to bring different provisions into force on different dates. The site's section pages show the commencement status of each section.
Is the DPDP Act in force right now?
Parts of it are. Chapter I (Sections 1-3) and the chapter establishing the Data Protection Board (Sections 18-26) have been in force since 13 November 2025. Most of the substantive obligations that affect day-to-day business - Chapters II and III, and the Board's enforcement powers - take effect 13 May 2027. Until a section is specifically notified, it isn't a live legal obligation.
Why did it take over two years after enactment (Aug 2023) to start notifying commencement?
The Act itself doesn't say why; in practice, the government used the time to finalise the DPDP Rules through a public consultation (draft Rules were published for feedback in January 2025) and to set up the Data Protection Board, before switching on enforceable obligations.
Does "personal data" only mean things like name and phone number?
No - clause (t) defines it broadly as any data about an individual who is identifiable by or in relation to that data. That can include device identifiers, location data, or any other data point that, alone or combined with other data, makes someone identifiable.
Is anonymised or aggregated data still "personal data" under the Act?
If an individual is no longer identifiable from the data, it falls outside the definition in clause (t) and generally outside the Act's scope. Whether a given anonymisation technique genuinely prevents re-identification is a fact-specific question, not a label you can simply attach.
If our servers are outside India, does the Act still apply?
It can. Section 3(b) looks at whether you're offering goods or services to people in India, not where your servers or company are located.
Does scraping public social media profiles fall outside the Act?
Not automatically. The clause (c)(ii) exemption applies to data made public by the Data Principal themselves or under a legal publication obligation - it doesn't create a general exemption for any data that happens to be visible online, and other provisions of the Act may still apply to how that data is subsequently processed.

Related pages

Chapter II — Obligations of Data Fiduciary

The next chapter of the Act.

Read Chapter II

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

DPDP Key Concepts

Plain-language definitions of the terms the Act introduces.

Open the dictionary