1) This Act may be called the Digital Personal Data Protection Act, 2023.
(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.
Please keep in mind that this form is only for feedback and suggestions for improvement. Unfortunately, questions will not be answered.
"Every great law begins with a name, a territory, and a date." - Legal Tradition
Section 1(1). This Act may be called the Digital Personal Data Protection Act, 2023.
Section 1(2). It extends to the whole of India and applies to—
Section 1(3). It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint, and different dates may be appointed for different provisions of this Act, and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.
Related Notification:
Section 1 is the foundation of the DPDPA - it answers three fundamental questions:
Question 1: What is this law called?
Answer (Section 1(1)): "Digital Personal Data Protection Act, 2023"
Why it matters: Name defines scope - it's about DIGITAL data, PERSONAL data, PROTECTION
Question 2: Where does this law apply?
Answer (Section 1(2)):
Why it matters: Google in USA, Facebook in Ireland, TikTok in Singapore ALL subject to DPDPA if they serve Indian users
Question 3: When does this law come into effect?
Answer (Section 1(3)): When Central Government notifies in Official Gazette
Status: Passed by Parliament August 2023, Rules notified January 2025, Act expected to be enforced in phases starting 2025
Why it matters: Organizations need time to prepare; government can phase in different provisions
Key Insight: Section 1 establishes DPDPA as one of the world's most ambitious data protection laws in terms of territorial reach - it claims jurisdiction over ANY processing of Indian personal data ANYWHERE in the world.
Statutory Language: "This Act may be called the Digital Personal Data Protection Act, 2023."
1. "Digital" - Scope Limitation
Includes:
Excludes:
Example 1 - Covered:
Doctor writes prescription on paper → Scanned and stored in hospital's electronic medical records system → ✓ DPDPA applies
Example 2 - Not Covered:
Doctor writes prescription on paper → Filed in physical cabinet, never digitized → ✗ DPDPA doesn't apply (other laws like Indian Medical Council Act may apply)
Why "Digital" Limitation?
2. "Personal Data" - Subject Matter
Definition (Section 2(t)): Data about an individual who is identifiable by or in relation to such data
Covers:
Doesn't Cover:
3. "Protection" - Legislative Intent
The law PROTECTS personal data - it's a rights-based law, not a data-use enablement law
Focus:
4. "Act" - Legal Status
Parliamentary legislation - highest form of domestic law (after Constitution)
Hierarchy:
5. "2023" - Year of Enactment
Identifies which version of the Act
Timeline:
Legal Tradition: Every Act has a "short title" for convenient reference
Full vs Short Title:
Usage: Courts, lawyers, businesses refer to the law as "DPDPA 2023" or simply "the Act"
Section 1(2) is REVOLUTIONARY - it gives DPDPA global reach.
Statutory Language: "the processing of digital personal data within the territory of India where the personal data is collected—(i) in digital form; or (ii) in non-digital form and digitised subsequently"
Rule: If processing happens IN INDIA, DPDPA applies
"Territory of India" means:
Two Collection Scenarios:
Scenario 1(i): Collected Digitally
Example: User fills online form on website, submits via app, provides data through chatbot
Location of Server Irrelevant: Even if data goes to US servers, if collection happened in India → DPDPA applies
Scenario 1(ii): Collected Non-Digitally, Then Digitized
Example:
All covered once digitized
Critical Point: "Collected" in India
Not "processed" - COLLECTED
Example:
Statutory Language: "the processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India"
This is the GDPR-inspired "long-arm" provision.
Rule: Foreign companies processing Indian data OUTSIDE India are subject to DPDPA IF they offer goods/services to Indians
Four Elements Required:
Key Phrase: "in connection with"
Broad connection - doesn't require processing to be "for the purpose of" offering, just "in connection with"
What is "Offering Goods or Services"?
✓ Clearly Offering:
⚠️ Arguably Offering:
✗ Not Offering:
Examples:
Example 1: Google (USA)
Example 2: Netflix (USA)
Example 3: TikTok (China/Singapore)
Example 4: Small US Blogger
GDPR Article 3(2) - Territorial Scope:
"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
DPDPA Section 1(2)(b) is almost identical to GDPR 3(2)(a)
Key Difference: GDPR also covers "monitoring of behaviour" - DPDPA doesn't explicitly include this
| Aspect | GDPR Art 3(2) | DPDPA Sec 1(2)(b) |
|---|---|---|
| Offering goods/services | ✓ Covered explicitly | ✓ Covered explicitly |
| Monitoring behaviour | ✓ Covered explicitly (Art 3(2)(b)) | ? Arguably covered under "in connection with" but not explicit |
| Threshold | "data subjects who are in the Union" | "Data Principals within the territory of India" |
Challenge 1: Jurisdiction
Indian Data Protection Board can issue orders to foreign companies, but enforcing those orders abroad is difficult
Example:
Solution: Board can:
Challenge 2: Service of Notice
How to serve legal notice to foreign company with no Indian presence?
Solution (Rule 2): DPDP Rules require foreign Data Fiduciaries to:
Challenge 3: Discovery & Evidence
Investigating foreign company's data practices when servers abroad
Solution: Board's powers (Section 32):
Statutory Language: "It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint, and different dates may be appointed for different provisions of this Act"
Commencement = When law becomes enforceable
Stage 1: Bill Introduced in Parliament
Digital Personal Data Protection Bill, 2023 - August 3, 2023
Stage 2: Parliamentary Debate & Voting
Stage 3: Presidential Assent
President signs - August 11, 2023
NOW IT'S AN "ACT" but NOT YET ENFORCEABLE
Stage 4: Rules Drafted
Ministry of Electronics & IT drafts subordinate rules
Rules published for public consultation - 2024
Final Rules notified - January 3, 2025
Stage 5: Commencement Notification
Central Government notifies date(s) in Official Gazette
Status: Awaited (as of January 2025)
Stage 6: Enforcement Begins
Data Protection Board constituted, penalties enforceable, rights exercisable
Expected: Phased rollout 2025-2026
Reason 1: Rules Must Be Finalized
DPDPA delegates many details to Rules (consent manager standards, breach notification procedures, penalties calculation, etc.). Can't enforce Act without Rules.
Reason 2: Institutional Setup
Reason 3: Industry Preparation Time
Organizations need time to:
Typical Gap: 6 months to 2 years (GDPR had 2-year preparation period)
Key Phrase: "different dates may be appointed for different provisions"
This allows PHASED rollout - bringing different sections into force at different times
PHASE 1 (Day 1 - Immediate)
Effective Date: January 2026 (hypothetical)
Provisions:
Rationale: Institutional framework must exist before rights/obligations enforced
PHASE 2 (6 months later - July 2026)
Provisions:
Rationale: Core obligations first, gives organizations 6 months to comply
PHASE 3 (12 months later - January 2027)
Provisions:
Rationale: More complex obligations need more preparation time
PHASE 4 (18 months later - July 2027)
Provisions:
Rationale: Rights become enforceable once organizations have systems in place; penalties begin after grace period
Note: Actual schedule will be determined by Central Government
General Rule: Laws apply PROSPECTIVELY (from commencement forward), not RETROSPECTIVELY (to past actions)
DPDPA Application:
| Scenario | DPDPA Applies? | Reasoning |
|---|---|---|
| Data collected BEFORE commencement, processed AFTER | ✓ YES | Processing after commencement is covered |
| Data collected AND processed BEFORE commencement | ✗ NO (retrospectively) | But ongoing processing after commencement = covered prospectively |
| Breach occurred BEFORE commencement, discovered AFTER | ⚠️ COMPLEX | Breach itself not penalized, but failure to notify after commencement may be |
| Consent obtained BEFORE commencement (invalid by DPDPA standards) | ✓ Must obtain fresh valid consent after commencement | Ongoing processing requires valid consent |
Hugo Grotius (1583-1645), "On the Law of War and Peace": States have absolute sovereignty within their territorial boundaries.
Application to Section 1(2)(a): India has unquestioned right to regulate data processing within its territory
Effects Doctrine: State can regulate foreign conduct if it has substantial effects within the state's territory
Origin: US antitrust law (Alcoa case, 1945) - foreign cartels affecting US markets subject to US law
Application to Section 1(2)(b):
Legitimacy: Widely accepted in international law (EU's GDPR uses same principle)
Two Competing Visions:
Model 1: Data Localization (China, Russia)
Model 2: Free Flow of Data (USA, Big Tech)
Model 3: Regulated Cross-Border Flows (EU, India via DPDPA)
DPDPA's Position: Model 3 - Pragmatic middle ground
Article 245(1): "Parliament may make laws for the whole or any part of the territory of India"
Article 245(2): "No law made by Parliament shall be deemed to be invalid on the ground that it would have extra-territorial operation"
Application:
Entry 13: "Participation in international conferences, associations and other bodies and implementing of decisions made thereat"
Argument: DPDPA implements international data protection standards (similar to GDPR, APEC Privacy Framework)
Article 248: Parliament has exclusive power to make laws on matters not in State or Concurrent Lists
Entry 97, List I: "Any other matter not enumerated in List II or List III..."
Data Protection: Not explicitly in State or Concurrent Lists → Residuary power of Parliament
K.S. Puttaswamy v. Union of India (2017): Right to privacy is fundamental right under Article 21
DPDPA as Implementation: Parliament enacting DPDPA to PROTECT constitutional right to privacy
Quote from Puttaswamy:
"The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution."
| Aspect | India (DPDPA) | EU (GDPR) | California (CCPA) | China (PIPL) |
|---|---|---|---|---|
| Territorial Scope | Whole of India | All 27 EU member states | California only (one state) | Whole of China |
| Extraterritorial Reach | ✓ Yes (1(2)(b)) | ✓ Yes (Art 3(2)) | Limited (must do business in CA) | ✓ Yes (similar to GDPR) |
| Trigger for Foreign Cos | Offering goods/services to Indians | Offering goods/services to EU citizens OR monitoring behaviour | Doing business in CA + meeting thresholds | Offering goods/services to Chinese |
| Data Localization | Not required (Section 16 allows cross-border with safeguards) | Not required (Chapter V allows transfers with safeguards) | Not required | ✓ Required for "critical information infrastructure" |
| Commencement | Phased (notified by Govt) | May 25, 2018 (2 years after adoption) | Jan 1, 2020 (CCPA) Jan 1, 2023 (CPRA) |
Nov 1, 2021 |
1. Indian Companies
ALL Indian companies processing digital personal data → Covered
2. Foreign Companies with Indian Operations
Google India, Amazon India, Microsoft India → Covered (obviously)
3. Foreign Companies Serving Indians (No Indian Entity)
Netflix (no Indian subsidiary but serves Indians) → Covered via Section 1(2)(b)
4. Indian Branches of Foreign Companies
HSBC India, Citibank India → Covered
5. Individual Professionals (if processing digital data)
Doctors with electronic medical records, CAs with client data in computers, lawyers with client files digitized → Covered
6. Startups & Small Businesses
Size irrelevant - even 1-person startup processing digital personal data → Covered
7. NGOs & Non-Profits
If processing donor data, beneficiary data digitally → Covered
8. Government & Public Authorities
Subject to DPDPA (with some exemptions under Section 17)
PHASE 1: Assessment (Now - 3 months before commencement)
☐ Conduct data inventory (what personal data do we process?)
☐ Map data flows (collection → storage → processing → deletion)
☐ Identify legal basis for processing (consent vs Section 7 grounds)
☐ Assess if we're Significant Data Fiduciary (Section 10 criteria)
☐ Review existing privacy policies
☐ Gap analysis: Current practices vs DPDPA requirements
PHASE 2: Technical Implementation (3 months before commencement)
☐ Implement consent management system
☐ Update notice mechanisms (Section 5 compliance)
☐ Enhance security measures (Section 8 compliance)
☐ Build data subject rights portal (access, correction, erasure - Sections 11-12)
☐ Implement breach detection and notification systems (Section 8(6))
☐ Update data retention and deletion policies
PHASE 3: Governance (2 months before commencement)
☐ Appoint Data Protection Officer (if SDF) (Section 10)
☐ Establish grievance redressal mechanism (Section 13)
☐ Update vendor contracts (Data Processing Agreements)
☐ Train employees on DPDPA obligations
☐ Create compliance documentation (policies, procedures, records)
PHASE 4: Legal (1 month before commencement)
☐ Update Terms of Service
☐ Update Privacy Policy (link to Section 5 notice requirements)
☐ Review and update all consent forms
☐ Establish record-keeping systems for compliance demonstration
☐ Prepare for potential Board inquiries/audits
PHASE 5: Post-Commencement (Ongoing)
☐ Monitor compliance continuously
☐ Conduct Data Protection Impact Assessments (if SDF)
☐ Annual Data Protection Audits (if SDF)
☐ Stay updated on Board guidance and rules
☐ Review and improve processes based on experience
Section 1 is the gateway to India's data protection regime.
"A journey of a thousand miles begins with a single step." - Lao Tzu
The DPDPA's journey begins with Section 1 - defining its name, its reach, and its timeline.
Section 1 establishes DPDPA as a comprehensive, globally-reaching, rights-based data protection framework - the foundation upon which all subsequent sections build.
Section 1 DPDPA 2023 - Short Title, Extent and Commencement
© 2026 Prepared by Advocate (Dr.) Prashant Mali
International Data Protection Lawyer | Cyber Law Expert