India DPDPA: Article 1 – Short Title and Commencement

1. Short Title and Commencement

(1) This Act may be called the Digital Personal Data Protection Act, 2023

(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette,
appoint and different dates may be appointed for different provisions of this Act and any reference in any such
provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.

What Article 1 Means for Your Business

Article 1 establishes the official name of the law, the Digital Personal Data Protection Act, 2023, and gives the Central Government the power to bring different provisions into force on different dates by notification in the Official Gazette. This phased commencement mechanism was used to operationalise the Act through the DPDP Rules 2025, notified on 13 November 2025.

• The Act does not have a single commencement date, different sections came into force at different times, so compliance obligations must be tracked against official gazette notifications rather than a single fixed date.
• As of November 2025, the DPDP Rules 2025 are in force in a phased manner, some provisions apply immediately, others after 12 months, and the remainder after 18 months from notification.
• Businesses should monitor MeitY notifications to know exactly which obligations are currently enforceable versus those that are pending.
• The Act applies to digital personal data only, non-digitised records are outside scope unless subsequently digitised.