The Scheme of the Act, and What Is Actually in Force

In one line

The Act has forty-four sections and one Schedule in three visible parts, and it commences in three tranches on 13 November 2025, 13 November 2026 and 13 May 2027, so that as this book is written the machinery exists and the duties do not.

The map of the Act

Forty-four sections and one Schedule, in nine Chapters.

The Chapter numbers matter, because section 17(1) exempts "the provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16". An answer on exemptions that cannot say what Chapters II and III contain cannot state what is exempted. Chapter 1310.

Section 1: short title and commencement

Sub-section (1): "This Act may be called the Digital Personal Data Protection Act, 2023."

Sub-section (2): it comes into force on such date as the Central Government may by notification appoint, "and different dates may be appointed for different provisions", and a reference in a provision to the commencement of the Act is a reference to the coming into force of that provision.

That last clause matters more than it looks. Where a provision speaks of "the commencement of this Act", for instance section 5(2) on consent given before commencement, it means the commencement of that provision, not of the Act as a whole.

The three tranches

G.S.R. 843(E), Ministry of Electronics and Information Technology, New Delhi, 13 November 2025, made under section 1(2), appoints:

Tranche one, 13 November 2025, the date of publication:

• section 1(2) and section 2 (definitions);
• sections 18 to 26 (the Data Protection Board);
• sections 35, 38, 39, 40, 41, 42, 43 (protection of good-faith action, consistency with other laws, bar of jurisdiction, rules, laying, power to amend the Schedule, and removal of difficulties); and
• section 44(1) and (3) (the amendments to the Telecom Regulatory Authority of India Act, 1997 and to the Right to Information Act, 2005).

Tranche two, 13 November 2026, one year from publication:

• section 6(9) (the Consent Manager registration); and
• section 27(1)(d) (the Board's function in relation to a Consent Manager).