(1) This Act may be called the Digital Personal Data Protection Act, 2023. (2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint; and different dates may be appointed for different provisions of this Act.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 1 does two things: it names the Act and creates the mechanism for its commencement. Sub-section (2) is the operative clause that matters for compliance planning: it gives the Central Government the power to bring different provisions into force on different dates. This is why the DPDP Act does not have a single enforcement date — different obligations can (and do) switch on at different times. The Rules commencement under Rule 1 follows the same two-phase structure.
Rule 1 of the DPDP Rules 2025 notified two separate commencement dates. Rules 1, 2 and 4 came into force on 13 November 2025. All remaining operational rules (3, 5-23) have not yet commenced. The same mechanism applies to the Act — the May 2027 enforcement window referenced in public communications is a projected date for Phase 2 commencement, not a statutory fixed date.
A provision that has not yet commenced is not yet law. You are not non-compliant for failing to meet an obligation that has not been brought into force. However, building to the full obligation standard before commencement is best practice — the Board will not grandfather in organisations that did not prepare.