Section 1 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 1 does two small things. It gives the law its name, and it says the law starts on whatever date or dates the Central Government notifies. Because the second sub-section allows a separate date for each provision, section 1 is the reason the Act has been brought into force in stages rather than all at once. If you need help placing your own processing against these dates, a legal consultation is a sensible first step.
The Act is called the Digital Personal Data Protection Act, 2023 (No. 22 of 2023; assent on 11 August 2023). It comes into force on such date as the Central Government appoints by notification in the Official Gazette, and different dates may be appointed for different provisions. Inside any provision, a reference to "the commencement of this Act" means the date that particular provision came into force. The Act itself names no single start date.
What section 1 says
| Sub-section | What it provides |
|---|---|
| 1(1) | The Act may be called the Digital Personal Data Protection Act, 2023. |
| 1(2) | The Act comes into force on the date the Central Government appoints by notification in the Official Gazette. Different dates may be appointed for different provisions. Any reference in a provision to the commencement of the Act is read as a reference to the coming into force of that provision. |
Nothing in the text of the Act fixes a calendar date. The Act was published in the Gazette of India (Extraordinary) on 11 August 2023, but publication is not commencement. The Act became operative provision by provision through notifications. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates, so check the Rules and the commencement notifications for the provision you are working with.
Why "different dates for different provisions" matters
Many provisions of the Act depend on machinery that has to exist first. Section 18(1), for example, says the Data Protection Board of India is established "with effect from such date as the Central Government may, by notification, appoint". Until the Board exists, there is nobody to receive a breach intimation under section 8(6) or a complaint under section 27. Sections on consent managers (section 6(9)) need registration conditions that are "as may be prescribed", which means they wait for the Rules. Staggered commencement lets the Government switch on the definitions and institutions first and the duties later.
For a business this has a practical consequence. You cannot answer "is the DPDP Act in force?" with a single yes or no. You answer it per provision: is the duty you are looking at (notice, consent, breach reporting, children, Significant Data Fiduciary duties, penalties) in force on the date of the processing you are examining?
The commencement reference inside other sections
The last limb of section 1(2) says that "any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision". This matters because the Act counts time from "commencement" in several places.
| Provision | Where the word appears | What runs from commencement |
|---|---|---|
| Section 5(2) | Consent given "before the date of commencement of this Act" | The Data Fiduciary must give a notice as soon as reasonably practicable, and may continue processing until the Data Principal withdraws consent. |
| Section 17(5) | "before expiry of five years from the date of commencement of this Act" | The window in which the Central Government may declare that a provision shall not apply to a Data Fiduciary or class. |
| Section 43(2) | "after the expiry of three years from the date of commencement of this Act" | No order to remove difficulties may be made after this period. |
Read with section 1(2), these periods run from the date the relevant provision came into force, not from a single Act-wide date. If the provision containing the reference came into force on a later date than other parts of the Act, the clock is tied to that later date. The Act does not itself say which notification applies, so for any deadline that depends on it, identify the notification.
What section 1 does not do
Section 1 does not create a duty, a right or a penalty. It does not say that a business must already be compliant on the date of Gazette publication. It also says nothing on how long a business has to prepare, because that is left to the commencement notifications and the Rules. If an article, vendor or client tells you that "the Act applies from date X", ask which provisions, and ask for the notification.
Practical examples
Example 1: a retailer preparing a privacy notice. A retailer has customers who gave consent years ago. Section 5(2) asks for a fresh notice "as soon as it is reasonably practicable" after commencement. The retailer should confirm the date on which section 5 came into force and plan the notice from that date, rather than from the date of Gazette publication.
Example 2: a startup asking about the Board. A startup wants to know whether it can complain to the Data Protection Board today. The answer depends on whether section 18 has been brought into force by notification and whether the Board has been set up. Section 1(2) and section 18(1) together show why the answer is not contained in the Act alone.
Example 3: a company reading an exemption. Section 17(5) lets the Central Government exempt a Data Fiduciary or class for a specified period if it acts before five years from commencement. A company that hears about a possible exemption should check both the notification and the date from which the five years run.
Common mistakes
- Treating the Gazette publication date (11 August 2023) as the date on which every duty began.
- Assuming one commencement date for the whole Act. Section 1(2) allows different dates for different provisions.
- Quoting timelines from secondary sources without checking the Rules and the commencement notifications.
- Counting the five-year and three-year periods in sections 17(5) and 43(2) from the wrong date.
Need help with DPDP commencement and compliance planning?
If you are mapping which DPDP provisions already apply to your processing and which are still to come, a short review of your data flows against the notifications can set out a sensible order of work. Start with our legal consultation service and we will go through the provisions that bear on your business.
Key takeaways
- Section 1(1) gives the short title: the Digital Personal Data Protection Act, 2023.
- Section 1(2) brings the Act into force on dates notified by the Central Government, and different dates may be appointed for different provisions.
- A reference to the "commencement of this Act" inside a provision means the coming into force of that provision.
- The Act names no single start date; check the DPDP Rules, 2025 and the commencement notifications.
- Sections 5(2), 17(5) and 43(2) all measure time from commencement.
Read next
- Introduction to the Digital Personal Data Protection Act, 2023
- DPDP Rules 2025: draft rules and key provisions
- Section 2 of the DPDP Act, 2023: definitions of data and processing
- Section 5 of the DPDP Act, 2023: notice for consent given before commencement
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.