India's data law leaves its own start date to notification

The workload

A SaaS founder with Indian users has two things to track once the Digital Personal Data Protection Act, 2023 applies to them: what the Act's text requires, and when each part actually starts applying, because the Act does not commence itself. Section 1(2) of the Act's own Gazette text, recording the President's assent on 11 August 2023, states it 'shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions.' Verified, quoted directly. The workload is consent design and a transfer check, not a single go-live date.

What the documents show

Verified: section 6(1) of the Act requires that consent from a 'Data Principal' be 'free, specific, informed, unconditional and unambiguous with a clear affirmative action,' and limited to the personal data necessary for the stated purpose; the Act's own illustration is a telemedicine app that may not bundle in access to a user's contact list. Verified: section 16(1) gives the Central Government power to restrict the transfer of personal data by a Data Fiduciary to a country or territory outside India that is 'so notified,' a blacklist model restricting transfer only to specifically notified countries, rather than the EU's model of requiring a lawful mechanism for every destination. As of this entry's retrieval date, the Act's text does not itself confirm which provisions are in force or which countries, if any, are notified under section 16; that status sits with the government's own notifications, which PRS India's own bill-tracking page can help locate but does not itself settle, labelled here as a secondary source on legislative status only.

The operating cost

The Act's text names no registration fee for an ordinary Data Fiduciary; its costs are structural: building a consent flow that meets section 6's standard, and, once section 16 provisions are notified, checking any restricted-country list before moving Indian users' data there. The Act authorizes financial penalties elsewhere in its schedule for breaches, which this entry does not restate here without the specific enforcement action that would trigger them.

The stop condition

Editorial: because commencement is provision-by-provision and government-notified, there is no single date at which the Act's obligations start or stop; a founder's actual duty on a given day is fixed by whichever sections have been separately notified into force by that date, a status this entry does not assume beyond what section 1(2) itself states.

• Which sections of the Act, if any, has the Central Government notified into force as of the date this is being read?
• Has the government issued a section 16 notification restricting transfer to any specific country, and does that list include a data destination this business uses?
• Does the consent flow capture a clear affirmative action for each specified purpose separately, rather than one bundled acceptance?

The Act reads as finished text and an unfinished switchboard at the same time: the obligations are written, and whether a given one is live depends on a notification this entry has not independently confirmed.