Section 1 — Short Title & Commencement

Section 1 is the shortest section in the Act and the easiest to skim past — a name and a commencement clause, the kind of text most readers jump over to get to the substance. But that commencement clause is doing real work. It's the reason a genuinely useful answer to "are we DPDPA-compliant yet?" starts with "compliant with which provision, as of when" rather than a flat yes or no.

The short title — 1(1)

Sub-section (1) names the statute: the Digital Personal Data Protection Act, 2023. Nothing turns on this beyond citation — it's how the Act refers to itself in later sections and how everyone else refers to it, including us throughout this site.

Commencement by notification, not by default — 1(2)

Sub-section (2) is the one that matters. It doesn't put a date in the statute at all. Instead it hands the Central Government the power to bring the Act into force "on such date as the Central Government may, by notification in the Official Gazette, appoint," and it explicitly allows "different dates" for "different provisions of this Act." Parliament passed the whole Act on 11 August 2023 and received presidential assent the same day, but passage and commencement are two separate events under this design — a section can exist on the statute book for years before it actually binds anyone.

That's exactly what happened here. The Act sat un-commenced for over two years while the Central Government worked out the implementing Rules, because several of the Act's obligations only make operational sense once the Rules spell out the "manner as may be prescribed" details the Act keeps deferring to (Section 5's notice format, Section 8(6)'s breach-intimation format, and so on).

What's actually in force today, and what isn't

The DPDP Rules, 2025 were notified on 13 November 2025, and Rule 1 of those Rules — not Section 1 of the Act — is where the real staggered timeline lives. Rule 1(2) brought Rules 1, 2 and 17-21 into force immediately on notification: definitions, and the provisions setting up the Data Protection Board itself (appointing its Chairperson and Members, board procedure, its functioning as a digital office). Rule 1(3) brings Rule 4 — Consent Manager registration — into force twelve months later, around 13 November 2026. Rule 1(4) pushes the bulk of the substantive machinery — Rule 3's notice content, Rules 5 through 16 covering consent mechanics and verifiable consent, security safeguards, breach reporting, and most Data Principal rights — to eighteen months after notification, around 13 May 2027.

Practically, that means the everyday reading of "DPDPA compliance" — notice-and-consent flows, breach response, rights fulfilment — isn't legally mandatory yet, but the runway to get there is fixed and short. Waiting for the May 2027 deadline to start is waiting for the deadline that ends the runway, not the one that starts it.

Why this matters in practice

Two consequences follow directly from how Section 1(2) is written. First, a notification bringing one provision into force says nothing about any other provision — you have to check what's actually been notified rather than assume the whole Act is live because you've heard "the DPDP Act is in effect." Second, because the Rules for the deferred provisions were published well before those provisions commence, organisations that wait until the commencement date to start reading them are choosing to compress an eighteen-month runway into whatever time is left. The Rules text doesn't change between publication and commencement — reading it early costs nothing and buys planning time that reading it late doesn't.

Illustration: a company reads that "the DPDP Act is now in force" in the press after the November 2025 Rules notification and treats notice-and-consent obligations as immediately mandatory. In fact, Rule 1(4) pushes those specific obligations to around May 2027 — the company has correctly identified that something is live, but not which something.

How Section 1 connects to the rest of the Act

Section 1(2) is the mechanism; Rule 1 of the DPDP Rules, 2025 is where that mechanism has actually been exercised so far. Every other section on this site describes what the Act requires once it applies — Section 1 is the reminder to check whether, and from when, it actually does for the specific obligation you're looking at.