Section 1: Commencement by Gazette notification
Read the applicable tranche before stating an obligation is live.
Commencement by Gazette notification
Applies to: Central Government
Different provisions may have different dates; reference to commencement follows the provision.
No blanket commencement inferred.
Official Gazette Text (Verbatim Publication)
Ministry of Law and Justice publication, Digital Personal Data Protection Act, 2023.
Mapped Operational Controls (13)
Enterprise obligations in the Control Master Matrix grounded in this statutory provision.
Significant Data Fiduciary Assessment (Section 10(1))
Assesses processing volume, sensitivity, and national security factors against SDF designation.
India-Resident Statutory DPO Appointment (Section 10(2)(a))
Appoints an India-resident Data Protection Officer reporting directly to the Board of Directors.
Independent Data Auditor Engagement (Section 10(2)(b))
Appoints an independent external auditor to conduct periodic compliance evaluations.
DPIA & Periodic Security Risk Audit (Section 10(2)(c))
Executes periodic Data Protection Impact Assessments (DPIAs) and periodic security audits.
Right to Information & Processing Summary (Section 11)
Furnishes Data Principals a summary of processed personal data and shared third-party identities.
Right to Correction, Completion & Erasure (Section 12)
Processes principal requests to correct inaccurate data, complete records, or erase obsolete data.
Right to Grievance Redressal (Section 13)
Provides timely, documented internal grievance resolution before regulatory escalation.
Right to Nominate Representative (Section 14)
Enables Data Principals to nominate a representative to exercise rights upon death or incapacity.
Data Principal Statutory Duties (Section 15)
Validates authentic principal claims and prevents false, frivolous, or impersonated requests.
Notified Cross-Border Transfer Restrictions (Section 16(1))
Blocks personal data transfers to countries blacklisted or restricted by the Central Government.
Sectoral Higher Transfer Standards Saving (Section 16(2))
Preserves stricter sectoral data localization and transfer mandates (RBI, SEBI, IRDAI).
Statutory Exemptions Governance (Section 17)
Evaluates legal process, law enforcement, debt recovery, and court order exemption perimeters.
Data Protection Board Inquiry Governance (Sections 18–26)
Maintains operational readiness for regulatory summons, inquiries, and institutional proceedings.