Commencement of provisions of the Digital Personal Data Protection Act, 2023

This notification by the Central Government sets the official start dates for different parts of the Digital Personal Data Protection Act, 2023. Instead of the whole law starting at once, the government has split the rollout into three phases based on the date this notification is published in the Official Gazette. The first group of sections takes effect immediately on the date of publication. This includes sub-section (2) of section 1, section 2, sections 18 to 26, sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44. The second phase begins exactly one year after the publication date. This activates sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27. The final phase starts eighteen months after the publication date. This activates sections 3 to 5, sub-sections (1) to (8) and (10) of section 6, sections 7 to 10, sections 11 to 17, section 27 (except clause (d) of sub-section (1)), sections 28 to 34, 36, 37, and sub-section (2) of section 44.

Key points

• The Central Government sets the dates when different sections of the Act come into force. [(a), (b), (c)]
• Certain sections, including section 2 and sections 18 to 26, take effect immediately on the date of publication. [(a)]
• Sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 take effect one year from the date of publication. [(b)]
• The remaining listed sections, including sections 3 to 5 and sections 7 to 17, take effect eighteen months from the date of publication. [(c)]

Common misreadings

• People might think the entire Act comes into force on a single day, but the notification splits the start dates into three distinct phases.
• People might assume the eighteen-month delay applies to all of section 27, but clause (d) of sub-section (1) of section 27 actually starts at the one-year mark.