Section 1: Short Title and Commencement
Section 1 doesn't create any obligation for anyone — it names the Act and hands the Central Government the power to switch different parts of it on at different times, by notification. It's the legal hook that makes the Act's own phased, multi-year rollout possible.
Quick summary
What Section 1 says
- Sub-section (1) — gives the Act its short title: the Digital Personal Data Protection Act, 2023.
- Sub-section (2) — the Act comes into force on whatever date(s) the Central Government appoints by notification in the Official Gazette, and different dates may be appointed for different provisions. Any reference elsewhere in the Act to “commencement of this Act” means the date that particular provision itself came into force — not necessarily the date of the Act as a whole.
Breaking it down
Section 1 is what lawyers call a commencement clause, and it's a standard feature of Indian legislation: Parliament passes the law and the President assents to it, but that doesn't mean every provision starts applying immediately. The government is given the flexibility to phase the rollout in — giving itself time to build supporting infrastructure (like the Data Protection Board), finalise subordinate rules, and give organisations advance notice before obligations become enforceable.
What actually happened, in sequence:
The Act received Presidential assent and was published in the Gazette. This is the Act's enactment date, not its commencement date for most purposes.
The Central Government issued the commencement notification alongside the DPDP Rules, 2025, bringing the Act's preliminary provisions and the chapter establishing the Data Protection Board into force.
The Consent Manager registration framework becomes operational, tracking the DPDP Rules' own Phase 2 date.
Most of the Act's substantive obligations — notice, consent, security safeguards, breach reporting, Data Principal rights, and the Board's enforcement powers — take effect.
See the DPDP Rules, 2025 for the same timeline from the Rules' side.
Why phase it at all?
Bringing 44 sections into force on a single day would mean either the Data Protection Board doesn't exist yet when the first breach needs reporting, or organisations get no runway to build compliant notice and consent flows before they're legally required to have them. Section 1(2) avoids both problems by letting government sequence the rollout: build the referee first, then phase in the rules of the game.
Why this section matters
It's tempting to treat Section 1 as boilerplate and skip to the substantive chapters. But in practice, it's the section that determines whether anything else in the Act actually binds you today. A provision doesn't apply just because it's printed in the Gazette — it applies from the date the Central Government has specifically notified it. Getting this backwards — assuming the whole Act has been “in force since 2023” — is one of the most common misunderstandings organisations have about their DPDP obligations.
Real-world example
MedCare Diagnostics, a multi-city diagnostic lab chain
MedCare's compliance lead uses Section 1 to answer a question the legal team keeps asking: “is the DPDP Act actually binding on us right now?”
- 2023–2025 — The Act existed on paper, but almost none of it had been notified into force. MedCare tracked it as a future compliance project, not a live obligation.
- 13 November 2025 onward — The Data Protection Board formally exists and preliminary definitions apply, but MedCare's day-to-day handling of patient data isn't yet governed by enforceable notice-and-consent obligations.
- 13 May 2027 — This is the date MedCare's compliance lead has built the real roadmap around — patient intake forms, consent capture for diagnostic reports shared with referring doctors, and the breach-response plan all need to be compliant by this date, because this is when Chapter II's obligations and the Board's enforcement powers both become live.
Who needs to care about this section
- Compliance and legal teams — for anchoring a roadmap to real dates instead of the Act's 2023 enactment date, which is easy to mistake for a compliance deadline.
- Anyone citing the Act in a contract or policy — a reference to “commencement of this Act” in another section means that section's own commencement date, not August 2023 or any single Act-wide date.
- Organisations tracking the DPDP Rules alongside the Act — the two share the same phased structure; see Rule 1 for the Rules' side of the same timeline.
Common questions
Is the DPDP Act in force right now?
Why did it take over two years after enactment (Aug 2023) to start notifying commencement?
How do I find out exactly which sections are in force at any given time?
Related sections
Section 2 — Definitions
Continue to the next section in sequence.
Read Section 2Chapter I — Preliminary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsDPDP Rules, Rule 1 — Short Title and Commencement
The Rules' own commencement clause, which tracks the same three-phase timeline as the Act.
Read Rule 1