Section 1 - Short title and commencement

Key point

Clause-by-clause commentary on the short title of the Act, the delegated commencement power in Section 1(2), the three-phase commencement notification of 13 November 2025 and the meaning of "commencement of this Act"

1. Why does Section 1 matter when it merely gives the Act a name and commencement mechanism?

Section 1 contains two apparently simple propositions.

First, under Section 1(1), the legislation is called the Digital Personal Data Protection Act, 2023.

Secondly, Section 1(2) provides the mechanism through which the Act is brought into force:

“It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint…”

The second limb is considerably more important than the first. It expressly permits the Central Government to appoint different dates for different provisions and further provides that where a provision refers to the “commencement of this Act”, that expression is to be understood as referring to the coming into force of that particular provision.

The drafting therefore rejects the assumption that an Act must necessarily commence as one indivisible statutory instrument.

That assumption would have been particularly problematic for the DPDP Act because the legislation establishes not merely substantive rights and obligations, but also an institutional regulator, procedural mechanisms, consent infrastructure, exemptions and a detailed subordinate legislative framework.

Section 1(2) therefore creates the legal foundation for phased commencement.

The Central Government exercised that power through G.S.R. 843(E), dated 13 November 2025. The notification divides the Act into three commencement groups.

The three dates are:

Phase	Exact commencement date	Character of provisions
Phase I	13 November 2025	Foundational, institutional and regulatory provisions
Phase II	13 November 2026	Consent Manager-related framework
Phase III	13 May 2027	Principal substantive data-protection regime

Thus, the question “When did the DPDP Act come into force?” does not have a sufficiently precise single-date answer.

The legally accurate answer is:

Different provisions of the DPDP Act came into force on different dates pursuant to Section 1(2).

2. Section 1(2) creates a provision-specific commencement model

The significance of the words “different dates may be appointed for different provisions” becomes apparent when the Act is mapped against the commencement notification.

Phase I, 13 November 2025

The following provisions came into force on the date of publication of the commencement notification:

• Section 1(2);
• Section 2;
• Sections 18 to 26;
• Section 35;
• Sections 38 to 43; and
• Sections 44(1) and 44(3).

This phase principally activates the institutional and foundational architecture.

The Data Protection Board framework is particularly significant. Sections 18 to 26 concern the establishment, composition, appointment and functioning of the Data Protection Board and related matters.

The Rules correspondingly brought Rules 1, 2 and 17 to 21 into force on 13 November 2025.

Therefore:

13 November 2025 is not the date on which the principal obligations of Data Fiduciaries became operational. It is the date on which the first tranche of the statutory and regulatory architecture became operative.

3. Phase II, 13 November 2026

The second phase commences one year from the publication of the Gazette, namely 13 November 2026.

The notification specifies:

• Section 6(9); and
• Section 27(1)(d).

The corresponding Rule is Rule 4.

Section 6(9) concerns the registration of Consent Managers, while Rule 4 provides the relevant regulatory mechanism.

This produces an important distinction between the consent regime itself and the Consent Manager infrastructure.

The principal consent provisions under Section 6(1), (8) and Section 6(10) do not commence until Phase III.

Accordingly:

Provision	Commencement
Section 6(1), (8), (10)	13 May 2027
Section 6(9)	13 November 2026
Rule 4	13 November 2026

This is not an accidental sequencing issue. It means that the regulatory infrastructure concerning Consent Managers becomes operational before the general consent architecture takes effect.

4. Phase III, 13 May 2027: when does the substantive DPDP regime actually begin?

The third phase is the most consequential.

The commencement notification provides that eighteen months from 13 November 2025, the following provisions come into force:

• Sections 3 to 5;
• Sections 6(1), (8) and 6(10);
• Sections 7 to 17;
• Section 27, except Section 27(1)(d);
• Sections 28 to 34;
• Sections 36 to 37; and
• Section 44(2).

The date is:

13 May 2027.

This is effectively the date on which the principal substantive compliance obligations of the DPDP Act become operational.

It includes the statutory provisions governing:

• application of the Act;
• grounds for processing;
• notice;
• consent;
• certain legitimate uses;
• general obligations of Data Fiduciaries;
• processing of children's personal data;
• Significant Data Fiduciaries;
• rights of Data Principals;
• duties of Data Principals;
• transfer of personal data outside India;
• exemptions;
• Board proceedings and appeals; and
• specified governmental powers.

The Rules follow substantially the same architecture. Under Rule 1(4), Rules 3, 5 to 16 and 22 to 23 commence eighteen months after publication, i.e. 13 May 2027.

5. The complete commencement map

For purposes of legal advice, the following is the more useful table.

Date	Phase	DPDP Act provisions	DPDP Rules	Principal legal consequence
11 August 2023	Enactment	DPDP Act receives Presidential assent	,	Act is enacted but substantive provisions await commencement
13 November 2025	Phase I	§1(2), §2, §§18 to 26, §35, §§38 to 43, §44(1), §44(3)	Rules 1, 2, 17 to 21	Foundational provisions and Data Protection Board architecture
13 November 2026	Phase II	§6(9), §27(1)(d)	Rule 4	Consent Manager registration framework
13 May 2027	Phase III	§§3 to 5; §6(1), (8), (10); §§7 to 17; §27 except §27(1)(d); §§28 to 34; §§36 to 37; §44(2)	Rules 3, 5 to 16, 22 to 23	Core substantive DPDP compliance regime

The commencement notification itself is therefore the indispensable companion to Section 1.

6. What does “commencement of this Act” mean under Section 1(2)?

The final part of Section 1(2) provides that:

“any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.”

This sentence is easy to overlook but has substantial interpretive importance.

Illustration

Suppose Section X says that something must happen within five years from the commencement of the Act. If Section X is itself brought into force on 13 May 2027, the reference to “commencement” within that provision is not automatically converted into 13 November 2025, merely because some other provisions commenced then.

The statutory text expressly instructs that the reference is to the commencement of that provision.

The provision therefore prevents the first commencement date from becoming an unintended universal reference point.

This is particularly relevant to provisions containing time limits.

Section 17(5), for example, empowers the Central Government to grant certain exemptions before expiry of five years from the date of commencement of the Act. Because Section 17 belongs to the third commencement group, Section 1(2)'s interpretive direction becomes important when determining the relevant commencement date for that subsection.

The better reading is therefore that, for a provision brought into force on 13 May 2027, its statutory reference to commencement points to 13 May 2027, rather than automatically to 13 November 2025.

7. Section 1 is therefore a temporal provision, not merely a title provision

Section 1 should consequently be understood as establishing three distinct propositions:

First, it identifies the statute.

Secondly, it delegates commencement to the Central Government through Gazette notification.

Thirdly, it expressly authorises staggered commencement and determines how references to commencement are to be interpreted.

Its practical effect can be expressed as:

Enactment ≠ notification ≠ commencement ≠ enforceability of every provision.

This distinction becomes indispensable when advising clients during the transition period.

A Data Fiduciary should not be told simply:

“The DPDP Act has been passed, so all obligations apply.”

Nor is the opposite statement accurate:

“The DPDP Act does not apply until 2027.”

Both propositions are overbroad.

The correct position is provision-specific.

8. Corresponding Rules and Schedules

Commencement group	DPDP Act provisions	DPDP Rules, 2025
Phase I, 13 November 2025	Section 1(2), Section 2, Sections 18-26, Section 35, Sections 38-43, Sections 44(1) and 44(3)	Rules 1, 2 and 17 to 21
Phase II, 13 November 2026	Section 6(9) and Section 27(1)(d)	Rule 4, read with the First Schedule
Phase III, 13 May 2027	Sections 3 to 5, Section 6(1) to (8) and 6(10), Sections 7 to 17, Section 27 except Section 27(1)(d), Sections 28 to 34, Sections 36 to 37 and Section 44(2)	Rules 3, 5 to 16 and 22 to 23, read with the Second, Third, Fourth and Seventh Schedules

Rule 1 of the DPDP Rules, 2025 mirrors Section 1 of the Act. It supplies the short title of the Rules and, through Rule 1(2) to 1(4), the staggered commencement of the Rules themselves. Section 1 and Rule 1 should therefore always be read together when determining whether a particular obligation is enforceable on a given date.