Statutory Text (Official Gazette)
(1) This Act may be called the Digital Personal Data Protection Act, 2023.
(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.
What Section 1 Means in Plain English
Section 1 does two things:
- Official Law Name: The formal title is the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), passed by the Indian Parliament and published in the Gazette of India on August 11, 2023.
- Phased Enforcement: Sub-section (2) gives the Central Government the power to bring different sections into force on different dates through gazette notifications. This provides companies with a transition window to build out compliance infrastructure before statutory fines become active.
When Each Part Comes Into Force
Using its Section 1(2) power, the government brought the Act in through a notification dated November 13, 2025:
| Date | What takes effect |
|---|---|
| November 13, 2025 | Sections 1, 2, 18 to 26 (Data Protection Board), 35, 38 to 43, and the RTI Act amendment in Section 44(3) |
| November 13, 2026 | Consent Manager registration (Section 6(9)) and the Board’s related power (Section 27(1)(d)) |
| May 13, 2027 | Everything else, including notice, consent, security, breach reporting, children’s data, user rights and penalties |
Until May 13, 2027, the older Section 43A of the IT Act and the SPDI Rules, 2011 continue to apply. Read the whole Act on the complete official text page.
Check if your website complies with Section 1
Scan your domain in seconds to detect tracking cookies, third-party analytics pixels firing before consent, and missing regional notices.