Chapter I of the DPDP Act: When Does the Act Apply?
Chapter I sets the foundations of the Digital Personal Data Protection Act, 2023: what the Act is called and when it starts (Section 1), the vocabulary the whole Act runs on (Section 2), and the scope of what the Act applies to (Section 3). You read this chapter first to answer one question before any obligation matters: does the Act apply to what we do?
In short
Chapter I is the Act's front door. Section 1 fixes the name and the staggered start dates. Section 2 defines the 28 terms every later section relies on. Section 3 draws the boundary of the Act: it covers digital personal data processed in India, and processing done abroad when it targets people in India, while carving out purely personal or domestic use and certain publicly available data. If Section 3 does not bring your processing into scope, the rest of the Act does not apply to it.
Commencement status of this chapter
StatutoryChapter I does not commence as a single block. Under Section 1, the Central Government may appoint different dates for different provisions, and it has. Do not assume the whole chapter is either in force or not.
Good practiceThe definitions are already live and the Data Protection Board is operational, so complaints can be filed now. The scope section commences with the main compliance obligations on 13 May 2027. Treat the period until then as build time, not a deferral: scoping whether the Act applies to you is a Section 3 exercise you should complete well before the deadline. Source: commencement notification G.S.R. 843(E) dated 13 November 2025.
The sections in this chapter
Short title and commencement
Names the Act and lets the Government appoint different start dates for different provisions.
Read Section 1 Section 2Definitions
Defines the 28 terms the Act runs on, including Data Principal, Data Fiduciary, personal data, processing and consent.
Read Section 2 Section 3Application of the Act
Draws the boundary: which processing is in scope, which targeting-India processing abroad is caught, and what is carved out.
Read Section 3How these three sections work together
Section 1 tells you the Act starts on dates the Government appoints, and it has appointed a staggered timeline. This is why the definitions can be live while the scope section is not.
Section 2 fixes the vocabulary. Whether you are a Data Fiduciary, whether something is personal data, and what counts as processing are all Section 2 questions that decide how Section 3 reads for you.
Section 3 uses those definitions to draw the boundary. Only once you are inside Section 3 do Chapter II obligations, Chapter III rights and the rest become relevant to your processing.
InterpretationThe practical sequence is Section 2 then Section 3: you cannot decide whether the Act applies without first knowing what its defined terms mean. Section 1 sits above both as the timing switch.
What a plain reading of Chapter I misses
The statutory text is short. The parts that trip organisations up are not on the page:
Section 2 is in force now but Section 3 is not until 2027. The Board and its complaint machinery already exist while the scope-defining provision is still pending. Plan to the earliest real obligation, not the latest.
Section 3(a)(ii) brings non-digital data into scope once it is digitised. Paper forms and records that are later scanned or keyed into a system become digital personal data. Many teams scope only their obviously digital systems.
Section 3(c)(ii) excludes data made public by the Data Principal, or by someone under a legal obligation to publish it. It is not a general "anything on the internet is fair game" exception.
Section 3(c)(i) covers an individual using data for their own household purposes. Once activity becomes commercial or is monetised, it tends to fall outside this carve-out, even if it started as a personal account.
Does the DPDP Act apply to you?
A quick reading of Section 3. This is a starting screen, not a legal opinion; the detail and edge cases live on the Section 3 page.
Good practiceIf you answered "yes" through the gate, the Act likely applies and Chapter II obligations become relevant. If you are unsure, the readiness assessment and the full Section 3 analysis will sharpen the answer.
Primary sources
Continue through the Act
Chapter I sets scope. Next comes what you must actually do once you are in scope.