Data Protection: Scope and Consent

In one line

The statute that answers the positive obligation in the privacy judgment: it says who may process personal data about you, on what basis, and what they must tell you first.

In the wording a student can write in an exam: the Digital Personal Data Protection Act 2023 applies to the processing of digital personal data collected in digital form or digitised afterwards, within India and also outside India where the processing is connected with offering goods or services to Data Principals within India; it permits processing only for a lawful purpose and only either with the consent of the Data Principal or for certain legitimate uses listed in section 7; and it requires that every request for consent be accompanied or preceded by a notice, and that the consent be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to such personal data as is necessary for the specified purpose, and withdrawable at any time.

The commencement, which must be stated first

This is the most important practical fact about the Act and it is the one most answers get wrong.

Section 1(2) provides that the Act shall come into force on such date as the Central Government may appoint, and that different dates may be appointed for different provisions. By notification G.S.R. 843(E) dated 13 November 2025 the Government appointed three dates, and the India Code consolidation records them:

• 13 November 2025: sections 2, 18 to 26, 35 to 43, and sub-sections (1) and (3) of section 44.
• One year from 13 November 2025: section 6(9) and section 27(1)(d), which are the Consent Manager registration provisions.
• Eighteen months from 13 November 2025: sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 except sub-section (1)(d), sections 28 to 34, 36, 37, and section 44(2).

Three consequences follow, and an answer that states them is doing better than an answer that recites the sections.

The definitions and the Board are in force; the obligations are not. Sections 18 to 26 establish the Data Protection Board and provide for its composition, so the institution exists. Chapters II and III, which contain every duty of a Data Fiduciary and every right of a Data Principal, commence at eighteen months.

Section 44(3) is in force and section 44(2) is not. That is why the amendment to section 8(1)(j) of the Right to Information Act 2005 has taken effect, as [The Right to Information] records, while section 43A of the Information Technology Act 2000, which section 44(2)(a) omits, is still on the statute book. A candidate who says that section 43A has gone is eighteen months early.