Does the DPDP Act Apply to You?

The Act only covers personal data: data about a person who can be identified by or from it (section 2(t), section 3). Data from which no person can be identified, such as figures about companies only, is outside it.

The Act covers personal data collected in digital form, or collected on paper and digitised later (section 3(a)). Paper records that you never digitise are outside it. If you later scan or type them in, the Act will apply.

The Act does not apply to personal data that a person uses for a personal or domestic purpose (section 3(c)(i)). This covers private individuals only, not businesses or organisations. Anything you do with the data beyond personal or household use may be covered.

The Act covers processing in India, and processing outside India only when it is connected with offering goods or services to people in India (section 3(a) and section 3(b)). If neither is true, the Act is likely not to apply.

The Act does not apply to personal data that the person made public themselves, or that someone had to make public under an Indian law (section 3(c)(ii)). It does apply to data that someone else made public, and to any other personal data you hold, such as data you collect, add or combine yourself. Check each kind of data you hold.

The Act does not apply to processing needed for research, archiving or statistics, if the data is not used to take any decision about a specific person and you follow the standards in the Second Schedule to the Rules (section 17(2)(b), rule 16). These standards include using only the data you need, keeping it accurate, keeping it no longer than needed and keeping it secure. If you do not meet them, the Act applies. This exemption applies from 13 May 2027, when the rest of the Act starts.

You answered Not sure to at least one question. Each one is explained below, with the section to read.

Based on your answers, the Act is likely to apply to this data (section 3). Most duties start on 13 May 2027. Key dates:

• 13 November 2025: definitions and the Data Protection Board are in force.
• 13 November 2026: Consent Managers can register with the Board (section 6(9), rule 4).
• 13 May 2027: the main duties start, including who is covered (section 3), notice, consent, security, breach reporting and rights (sections 3 to 17, rules 3 and 5 to 16). See all deadlines.

Some duties are lifted in specific cases, for example to enforce a legal right or claim, for courts and regulators, or to prevent or investigate offences (section 17(1)). Even then, you stay responsible for compliance and must keep the data secure (section 8(1) and section 8(5)). The Act also does not apply to processing by State bodies that the Government notifies (section 17(2)(a)).

If you decide why and how the data is used, you are a Data Fiduciary (section 2(i)). Your main duties: a lawful purpose with consent or a listed legitimate use (section 4, section 6, section 7), a clear notice (section 5, rule 3), security safeguards (section 8(5), rule 6), telling the Board and each affected person about a breach, with a detailed report to the Board within 72 hours (section 8(6), rule 7), erasing data you no longer need (section 8(7), rule 8), a published contact (section 8(9), rule 9), and handling rights requests and grievances (section 11 to section 13, rule 14).

For data you handle for others, you are a Data Processor (section 2(k)). The Act puts the duties on the Data Fiduciary, which may use you only under a valid contract (section 8(2)), must make sure the contract covers security safeguards (rule 6(1)(f)) and must make you erase the data when required (section 8(7)(b)). Expect these terms in your contracts. For your own data, such as your staff, you are a Data Fiduciary.

Whoever decides why and how the data is used, alone or with others, is the Data Fiduciary (section 2(i)). Someone who only processes it for a Data Fiduciary is a Data Processor (section 2(k)). Many organisations are both, for different data.

Services that handle data for you. You stay responsible for what they do on your behalf (section 8(1)). Use them only under a valid contract (section 8(2)) that covers security safeguards (rule 6(1)(f)), and make them erase the data when you must erase it (section 8(7)(b)).

Children and guardians. Before processing a child's data, or the data of an adult with a disability who has a lawful guardian, get verifiable consent from the parent or guardian (section 9(1), rule 10, rule 11). Do not process data in a way likely to harm a child's well-being, and do not track, monitor the behaviour of, or target advertising at children (section 9(2) and section 9(3)). Some classes and purposes, such as healthcare and educational institutions, are exempt from parts of this, under conditions (rule 12, Fourth Schedule).

Large scale or sensitive data. Only a Government notification makes an organisation, or a class of organisations, a Significant Data Fiduciary (section 10(1)). Factors include the volume and sensitivity of the data, risk to people's rights, India's sovereignty and integrity, electoral democracy, security of the State and public order. Size alone does not make you one. If you are notified: appoint a Data Protection Officer based in India and an independent data auditor, and do a Data Protection Impact Assessment and an audit every year (section 10(2), rule 13).

Startups. The Government may notify startups or other classes, based on the volume and nature of their data, to be freed from the notice duty (section 5), the accuracy duty (section 8(3)), the erasure duty (section 8(7)), section 10 and the right to access (section 11) (section 17(3)). This helps only if a notification covers you. Until then, plan for the full duties.

Not sure if it is personal data? If any person can be identified from the data, alone or with other data, treat it as personal data (section 2(t)).

Not sure if it is digital? Data in computers, phones, apps, email or the cloud is digital. Paper that you scan or type in later also counts (section 3(a)).

Not sure about personal or household use? It applies only to a private person, not to a business or organisation (section 3(c)(i)).

Not sure about India? Processing outside India is covered when it is connected with offering goods or services to people in India (section 3(b)).

Not sure if the data is public? Only data made public by the person themselves, or published under a legal duty, is outside the Act (section 3(c)(ii)).

Not sure about research? The exemption needs research, archiving or statistics only, no decisions about a specific person, and the Second Schedule standards (section 17(2)(b), rule 16).