Readiness assessment
The Act
The DPDP Act, explainedNotice · Section 5Consent · Section 6Security · Section 8The DPDP Rules 2025Glossary
Industries
Fintech & BankingHealthcare & PharmaE-commerce & RetailSaaS & TechnologyEdTechGCC & Global CentresBrowse all sectors
Implementation
DPDP implementationFintech & digital lendingDPDP services & partnersVirtual DPOGet certified
Resources
Readiness assessmentGuidesBy roleGlossaryNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter I · Preliminary

Section 1: Short title and commencement

The opening section does two things: it gives the Act its official name, and it sets out that the Act comes into force in stages, on dates the Central Government notifies.

Official text
Section 1Short title and commencement
Chapter
Chapter I · Preliminary
Status
In force (phased commencement)
Full compliance
13 May 2027
Applies to
Everyone (scope-setting)
Official citation
DPDP Act, 2023, s.1
Reading time
4 min
Updated
August 2026

At a glance

Section 1 of the Digital Personal Data Protection Act, 2023 states the Act's short title and its commencement. The Act does not switch on all at once: the Central Government notifies different provisions on different dates. The DPDP Rules, 2025 were notified on 13 to 14 November 2025, starting an 18-month phased rollout, and full compliance is expected by 13 May 2027.

Applies to Everyone (scope-setting)Chapter Chapter IFull compliance 13 May 2027Read time 4 min

Key takeaways

  • The Act's official name is the Digital Personal Data Protection Act, 2023.
  • It comes into force on dates the Central Government notifies in the Official Gazette.
  • Different provisions can start on different dates, the Act switches on in stages, not all at once.
  • The DPDP Rules, 2025 were notified on 13 to 14 November 2025, beginning an 18-month rollout.
  • The planning anchor the market is using is 13 May 2027 for full compliance.
  • "Commencement" of a provision means the date that provision comes into force, not the date of assent.

Who should read this

Anyone starting their DPDP journey should read this first, because it answers the question behind every compliance plan: not "is the Act in force?" but "which parts are in force, and by when must I comply?"

FoundersLegal / DPOCompliance leadsProduct / engineering

In plain language

Section 1 is housekeeping, but it is important housekeeping. Its first job is to give the law its short title, the name you cite in a privacy notice or a contract: the Digital Personal Data Protection Act, 2023.

Its second job matters more in practice. The Act does not become enforceable the moment it is passed. Instead it commences in stages: the Central Government issues notifications in the Official Gazette that bring specific provisions into force, and it may pick different dates for different provisions. So at any given moment some parts of the Act may be live while others are still waiting to be switched on.

That is why the useful question is never "has the DPDP Act started?" It has, in stages. The useful question is which obligations apply to you, and by when. Following the notification of the DPDP Rules, 2025 in November 2025 and the 18-month rollout that came with them, the date most Indian organisations are planning around is 13 May 2027.

The text of the law

Section 1: Short title and commencement

1(1) This Act may be called the Digital Personal Data Protection Act, 2023.

1(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint, and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.

Wording reproduced from the enacted Act. Always confirm against the official Gazette text for authoritative language.

Commencement timeline

DateWhat happened / happens
11 Aug 2023The Act receives Presidential assent and is published.
13–14 Nov 2025MeitY notifies the DPDP Rules, 2025, starting an 18-month phased rollout.
2026 (phased)Data Protection Board stood up; consent-manager registration and select provisions notified.
13 May 2027Full compliance expected: the date most organisations are planning to.

Dates reflect public MeitY notifications and the 18-month rollout window. Individual provisions commence on their own notified dates; confirm specifics against the Gazette.

What this means for you

  • Treat 13 May 2027 as your planning deadline, and work backwards from it.
  • Do not wait for "the Act to start", it has started in stages, and the runway is finite.
  • Map which obligations apply to you now, so nothing surfaces late.
  • Cite the Act by its short title in your notice and vendor contracts.
  • Next, read Section 2 (Definitions), the terms there decide which duties are yours.

Frequently asked questions

Is the DPDP Act in force?
Yes, in stages. The Act commences provision by provision on dates the Central Government notifies. The DPDP Rules, 2025 were notified in November 2025, and full compliance is expected by 13 May 2027.
What does "commencement" mean in Section 1?
The date a particular provision comes into force. Because different provisions can be notified on different dates, "commencement" is read per provision, not as a single switch-on date for the whole Act.
What is the DPDP compliance deadline?
The date the market is planning around is 13 May 2027, based on the 18-month rollout that followed the November 2025 notification of the Rules.
Does the entire Act apply to me right now?
Not necessarily. Provisions come into force in phases. The practical step is to identify which obligations already apply to your organisation and prepare for the rest before the deadline.

Sources

Related sections
Section 2: DefinitionsSection 5: NoticeSection 6: ConsentChapter I overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment