Does the DPDP Act apply to you? Scope, exemptions and edge cases

The DPDP Act applies to any organisation or individual, of any size or legal form, that processes personal data in digital form in India, and to processing outside India connected with offering goods or services to people in India (s. 3(a), 3(b)). Paper records count once they are digitised. Two things fall outside it altogether: an individual's personal or domestic use, and data the person herself made public or that someone was legally required to publish (s. 3(c)). The exemptions in section 17 switch off parts of the Act for specific activities, such as legal claims, research and some outsourcing, or, by notification, for named fiduciaries or classes (s. 17(3), 17(5)); none has been made as of 25 October 2026. These provisions take effect on 13 May 2027.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to your case.

• Everyone: The test in section 3, the nine questions, what exempt really means, Significant Data Fiduciaries, a memo for each activity.
• NGOs, trusts and researchers: NGOs and trusts, paper later digitised, research and evaluation, State bodies and their partners.
• Founders, CTOs and foreign companies: foreign SaaS, data of people outside India, startups, group companies.

The test in section 3, step by step

Section 3 is short, and every applicability question comes back to it.

1. Is it personal data? Personal data is "any data about an individual who is identifiable by or in relation to such data" (s. 2(t)). The test is whether she can be identified; a name need not appear. A beneficiary ID, a phone number, a photo, a vehicle number linked to a resident, or a case note that a field officer could match to one household all qualify. Our view: data falls outside only if it is truly anonymised, so that nobody can be identified from it or by combining it with other data you hold or could reasonably obtain; the Act sets no standard. Pseudonymised data, where you keep the key, does not.

2. Is it digital? The Act covers digital personal data (s. 2(n)) collected in digital form, or collected on paper and "digitised subsequently" (s. 3(a)). Processing means a "wholly or partly automated" operation on digital personal data, and the list includes collection, storage, retrieval, use, sharing and erasure (s. 2(x)).

3. Is the processing in India, or aimed at people in India? Processing within India is covered regardless of where the person is (s. 3(a)). Processing outside India is covered "if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India" (s. 3(b)).

4. Does an exclusion or exemption apply? Personal or domestic use, and data published by the person herself or under a legal duty, are outside the Act (s. 3(c)). Section 17 then exempts specific activities from parts of it, or, for notified security bodies and qualifying research, all of it.

Who you are matters far less than what you do. The Act's duties fall on a "Data Fiduciary", meaning any person who decides the purpose and means of processing, alone or with others (s. 2(i)). "Person" includes an individual, a company, a firm, an association or body of individuals whether incorporated or not, the State, and every other artificial juristic person (s. 2(s)). There is no turnover, headcount or data-volume threshold. Volume matters only for designation as a Significant Data Fiduciary (s. 10(1)) and for the Third Schedule's erasure periods, which apply to very large e-commerce, gaming and social media platforms (Rule 8(1)), and for any notification under s. 17(3).

Nine questions, per activity

Run it once for each activity. A foundation can be fully covered for its donor database, partly exempt for its impact evaluation and outside the Act for a paper register nobody has photographed.

If you are only a processor:

• The Act's duties sit on the fiduciary you work for, and it remains responsible for what you do (s. 8(1)).
• They reach you through the valid contract it must have with you: security, erasure, stopping after withdrawal, breach notice back to it (s. 8(2), 8(5), 8(7)(b), 6(6), Rule 6(1)(f)).
• The moment you use the data for a purpose of your own, such as your analytics or model training, you become a fiduciary for that purpose.

Wherever you are a fiduciary, the next question is your basis for each purpose: consent, or a named legitimate use in s. 7. The DPDP Act and Rules guide covers roles and bases, and processor contracts the contract.

What each exemption switches off, and what it leaves on

"Exempt" in this Act rarely means exempt from everything.

In practice, a company relying on s. 17(1)(a) to analyse an employee's emails for a legal claim does not need her consent or a notice, but must still secure the data and answer for its forensic vendor. The exemptions in s. 17(1) and 17(2)(b) apply by their own terms, without any notification; only s. 17(2)(a), 17(3) and 17(5) need one. None is self-certifying in practice: if your reliance is questioned, you will need to show the facts that bring you within it. Record each reliance with the clause and the facts; the memo below shows how.

Are you a Significant Data Fiduciary?

The government may notify any fiduciary or class as a Significant Data Fiduciary on an assessment of factors that include (s. 10(1)):

• the volume and sensitivity of the personal data processed;
• the risk to the rights of Data Principals;
• the potential impact on the sovereignty and integrity of India;
• the risk to electoral democracy;
• the security of the State;
• public order.

The status comes only by notification; you cannot become one by crossing a threshold, and no threshold is set. None has been notified. A notified SDF must appoint an India-based DPO responsible to its board and an independent data auditor (s. 10(2)(a)–(b)), and carry out a DPIA and audit every twelve months, check its algorithmic software and keep specified data in India (Rule 13). The government may call for information to assess whether to notify you (Rule 23, Seventh Schedule, item 3). We recommend that large financial, health, telecom and platform businesses build the DPIA and audit habit before any notification arrives.

Worked cases, from NGOs to group companies

NGOs, trusts and societies

Covered, fully. A public charitable trust (through its trustees, as a body of individuals, s. 2(s)(v)), a registered society and a section 8 company are all "persons" (s. 2(s)), and charitable purpose is not an exemption. An NGO that decides why and how it uses beneficiary, donor, volunteer or staff data is a Data Fiduciary for it.

This is a larger change for the sector than for companies. The SPDI Rules under IT Act s. 43A, which run until 13 May 2027, bind "body corporates". Section 43A's explanation defines that as a company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. A section 8 company is a company. Whether a trust or society was caught turned on that test. Our view: many trusts and societies not engaged in commercial or professional activities probably fell outside it, and for them the DPDP Act will be the first data protection law that clearly reaches them.

What to do: decide your role programme by programme, since you may be a fiduciary for one and the State's processor for another. Then find the data held outside your systems, on field staff's phones and in WhatsApp groups. DPDP for NGOs covers both in depth.

A foreign SaaS company selling into India

Covered for its Indian activity, mainly as a processor. Take a company in Singapore whose attendance software is used by Indian schools. Its processing happens abroad, but it is "in connection with" offering services to people in India, so s. 3(b) applies.

The role decides what that means. For the schools' student and staff records, the company processes on the schools' behalf, so it is a Data Processor (s. 2(k)). The Act's duties sit on the schools, which must use it only under a valid contract and remain responsible for what it does (s. 8(1), 8(2)). Its own processing is different. Where it decides the purpose, as with its website visitors, sales leads, product analytics or any use of school data to train its own models, it is a fiduciary in its own right. It then needs its own notices and basis, and the children's rules in s. 9 apply to it directly.

The Act does not require a foreign company to appoint a representative in India. Only a Significant Data Fiduciary must have a DPO, who must be based in India (s. 10(2)(a)(ii)). Transfers are allowed unless the government restricts a destination by notification (s. 16(1)); none has been notified. Expect your Indian customers' processing terms well before May 2027. DPDP for SaaS startups has the questions they will ask.

Paper records later digitised

Outside while on paper; inside the moment they are digitised. The Act reaches personal data collected "in non-digital form and digitised subsequently" (s. 3(a)(ii)). A handwritten register in a block office is outside it. A photograph of a page of that register, sent to a WhatsApp group, is digitised personal data, and so is the spreadsheet a data-entry operator types from it.

• The notice problem. Where the record is a consent form signed on paper, the notice and consent on that form are what you will rely on once it is digitised. From now, design paper forms to the Rule 3 standard, so the digitised copy carries a valid record (s. 5(1), 6(10)).
• Photographs are digitisation. A facilitator photographing a filled form on her own phone has digitised it, onto a device you may not control. That is a security question under s. 8(5) and Rule 6, and an erasure question under s. 8(7).
• Mixed records. If a programme keeps paper case files but enters key fields into a database, the database is covered and the paper is not. Run the paper side to the same retention and access rules anyway, because any page may be scanned later.

Data mapping is where these records surface.

Personal or domestic use

Outside, but only for an individual acting in her private life. The exclusion covers "personal data processed by an individual for any personal or domestic purpose" (s. 3(c)(i)). A mother's family WhatsApp group, her phone contacts and her holiday photographs are outside the Act.

The exclusion does not stretch to:

• Organisations. Only "an individual" can use it. A resident welfare association logging visitors, a cooperative housing society running CCTV or a club keeping a members' list is an association of persons (s. 2(s)(v)) and a fiduciary.
• Work on personal devices. A volunteer who keeps beneficiaries' numbers on her own phone for the NGO's programme is processing for the NGO's purpose. The NGO is the fiduciary, and the phone is inside its security perimeter.

Publicly available data

Outside only when the person herself published it, or someone was legally required to. Section 3(c)(ii) excludes personal data made publicly available by the Data Principal herself, or by someone "under an obligation under any law" to publish it. The illustration to s. 3 gives the plain case: an individual blogging her views on social media has made that data public herself.

The exclusion is narrower than "anything on the internet":

The text sets no limit on later uses of data she published. Our view: rely on the exclusion only for what she published, in the context she published it, and to keep a record of where each item came from. A recruiter reading a public CV is on firm ground. A company scraping millions of profiles to train a model is relying on an untested reading. Where the data was public once and she has since deleted it, the exclusion is harder still to claim.

Data of people outside India

Covered when processed in India, but mostly exempt under a foreign contract. Section 3(a) covers processing within India without asking where the person lives. Section 17(1)(d) then switches off most of the Act where data of people outside India is processed "pursuant to any contract entered into with any person outside the territory of India by any person based in India".

Section 3(b) reaches foreign processing connected with offering goods or services to people in India. Unlike the GDPR, it has no separate limb for monitoring people's behaviour, so a foreign company that profiles people in India without offering them anything is arguably outside it.

Research, evaluation and statistics

Outside the Act, on strict conditions. The Act does not apply to processing "necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal" and the processing follows prescribed standards (s. 17(2)(b)). Rule 16 points to the Second Schedule. Its standards are lawful processing, data limited to what is necessary, reasonable accuracy, retention only as long as needed, reasonable security, and accountability of whoever decides the purpose and means.

For NGOs, foundations and universities, the test is what the data is used for:

• An impact evaluation that reports aggregate results: within the exemption, if it follows the standards and nobody uses the data to make decisions about individuals.
• A baseline survey that also decides who joins the programme: outside the exemption, because the data is used to decide something about specific people. The Act applies in full.
• A study that later feeds a targeting model: inside the exemption while it is research; outside it the moment the data is used to select or exclude individuals.

The exemption covers the processing, not the organisation. The same dataset can be exempt in the evaluation team's hands and fully covered once a programme team uses it to pick families. We recommend keeping research data in a separate store with its own access list, giving participants a notice anyway (the exemption does not require one), and writing down why each study qualifies.

State bodies, and the NGOs and vendors that work for them

Covered, with their own grounds and reliefs. The State is a "person" (s. 2(s)(vi)), so a department, a municipal body or a public sector undertaking that is an instrumentality of the State is a fiduciary. It gets grounds no private body has: providing prescribed benefits, services, licences and permits (s. 7(b), Rule 5, Second Schedule), and performing functions under law (s. 7(c)). It is also relieved of the erasure duty, the erasure right and, where no decision about the person is made, the correction right (s. 17(4)). An instrumentality notified under s. 17(2)(a), for sovereignty, security, foreign relations or public order, is outside the Act for that processing. We have found no such notification.

A private NGO or vendor delivering a government scheme does not inherit these. Section 7(b) is for the State and its instrumentalities. Our position: when you enrol, survey or serve beneficiaries on a department's instructions and for its purpose, you act as its processor, and your MoU or contract is your processing contract. Add a purpose of your own, such as fundraising or research, and you become a fiduciary for that purpose with no State ground behind you. DPDP for NGOs covers this, including a state department's DPDP affidavit for partner NGOs.

Startups and small organisations

Covered in full from 13 May 2027; no exemption has been notified. Section 17(3) lets the government, "having regard to the volume and nature of personal data processed", notify fiduciaries or classes, "including startups", to which the notice duty (s. 5), the accuracy and erasure duties (s. 8(3), 8(7)), the SDF duties (s. 10) and the access right (s. 11) do not apply. Section 17(5) allows wider exemptions for a set period, within five years of commencement. Neither power has been used.

Even a s. 17(3) notification would leave consent, security, breach notice, children's data, grievances and the other rights in place. It would also do nothing to the processing terms your enterprise customers will ask you to sign. Plan as if no exemption will come. If one does, it will remove some of the work and leave most of it. DPDP for SaaS startups covers the rest.

Group companies, and deals

Each entity is its own fiduciary; there is no group exemption. The Act looks at who determines the purpose and means of processing (s. 2(i)), entity by entity. A group with a parent, a lending subsidiary, a shared-services company and a CSR foundation has four fiduciaries, or fewer only where one genuinely processes for another as its processor.

One programme with shared policies and a shared consent platform is sensible. The notices, contact details, contracts and breach reporting must still be right for each entity. DPDP for large companies and groups covers running it.

Also covered: journalism and staff data

• Journalism. The Act contains no exemption for journalistic purposes; section 17 lists none. A media organisation is a fiduciary for its subscribers, staff and sources' data. How the Board will treat reporting itself is untested.
• Employees. Staff data is covered like any other. The employment ground in s. 7(i) covers employment purposes and safeguarding the employer from loss or liability, so most HR processing needs no consent. See employee data.

A one-page applicability memo, per activity

Write one for every activity you treat as excluded or exempt, and for any where the answer was close. It is the record you will need if the Board, a funder or a customer asks why the Act's duties did not apply. The law prescribes no format; this one is illustrative, and the example is a composite, not a client story.

Where the law is unclear

These are our positions until the Board or the courts decide otherwise.

Does a contract with an individual customer abroad bring an Indian company within s. 17(1)(d)? We assume not, for an Indian company's direct relationship with its own customers. Why: the clause reads most naturally as protecting India's outsourcing industry, where an Indian firm processes a foreign client's data. A literal reading, under which any contract with a person outside India qualifies, would exempt Indian banks and platforms from most duties for every customer who lives abroad. Would change if: the Board or a court reads the clause literally. Confidence: low.

Is a B2B SaaS company offering services "to Data Principals within the territory of India" (s. 3(b))? Yes, for the individual users in India who log in. Why: the individuals using the service are Data Principals in India, even if the contract is with their employer. Would change if: the Board confines s. 3(b) to services offered to individuals as consumers. Confidence: medium.

Can you use data the person published, for any purpose? The text sets no purpose limit, but we would not rely on that. Why: the exclusion turns on who made the data public, and a use far from the context of publication invites the argument that your compilation or profile is new processing outside it. Would change if: the Board adopts a broad reading in an early case. Confidence: medium.

When does research stop being research? When any output is used to decide something about a specific person. Why: the exemption is conditional on the data "not to be used to take any decision specific to a Data Principal" (s. 17(2)(b)). Would change if: guidance treats programme targeting from aggregate findings as compatible. Confidence: high.

Does photographing a paper form bring the whole paper file under the Act? No, only the digitised copy. Why: the Act applies to data "digitised subsequently" (s. 3(a)(ii)), and the paper original is not digital. Would change if: the Board treats a paper file as part of a digital record system. Confidence: medium.

Is anonymised data safely outside the Act? Only if re-identification is not reasonably possible. Why: the Act asks whether a person is "identifiable by or in relation to" the data (s. 2(t)), and sets no anonymisation standard. Linking a dataset to others can make people identifiable again. Would change if: the government sets an anonymisation standard. Confidence: medium.

Does the Act reach a foreign company that monitors people in India without selling them anything? Arguably not. Why: s. 3(b) is tied to "offering of goods or services"; there is no monitoring limb. Would change if: the Board treats profiling as "in connection with" an offering. Note that free, ad-funded services are already offered services. Confidence: low.

What to do this month

1. List your activities: each programme, product, database and vendor flow.
2. Run the nine questions for each, and write a one-page memo for every activity you treat as exempt or excluded.
3. For every activity that is covered, settle your role (fiduciary, processor or both) and your basis for each purpose. The DPDP Act and Rules guide explains both.
4. Put the covered activities into a dated plan. Ours, with versions for small and large organisations, is in DPDP compliance deadline: 13 May 2027, and the controls to finish are in the DPDP compliance checklist.

How we wrote this guide. We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), including its illustrations, the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) and the commencement notification G.S.R. 843(E). Statements about notifications and exemptions are as of 25 October 2026. Statements marked "our view" or "our position" are our judgement, not the law. This guide explains the law; it is not legal advice for your situation.