Does the DPDP Act apply to you? Who it covers, and from when
The Digital Personal Data Protection Act, 2023 applies to almost every business that handles personal data in digital form, whatever its size. Answer the four questions of section 3 below; the dates follow. This is not legal advice.
Four questions (section 3)
- Is it personal data? Any data about an individual who can be identified by it or in relation to it (section 2(t)): a name, a mobile number, an order history. Data only about companies is not covered.
- Is it digital? The Act covers personal data collected in digital form, and data collected on paper that you digitise later (section 3(a)). Records that stay on paper are not covered.
- Where is it processed? Processing in India is covered. Processing outside India is covered too when it is connected with offering goods or services to people in India (section 3(b)).
- Is it only personal or domestic use, or public data? An individual's personal or domestic use is outside the Act, and so is data that the person made public, or that someone had to make public under Indian law (section 3(c)).
If the data is personal, digital, processed in India or for people in India, and not one of those last cases, the Act applies to you as a Data Fiduciary: whoever decides why and how the personal data is processed (section 2(i)). The Act has no exemption by size or turnover.
From when
The Act came into force in three steps (notification G.S.R. 843(E) of 13 November 2025), together with the Rules (Rule 1):
- 13 November 2025: the definitions, the Data Protection Board and the powers to make rules, with Rules 1, 2 and 17 to 21.
- 13 November 2026: the registration of Consent Managers (section 6(9), Rule 4).
- 13 May 2027: what a business must do: notice, consent, security safeguards, breach intimation, children's data, the rights of Data Principals, and the penalties (sections 3 to 17 and 27 to 34, Rules 3 and 5 to 16).
Until 13 May 2027 these duties are not in force, but a notice, consent records and a breach plan take time to set up.
Exemptions (section 17)
- Most duties do not apply where the processing is needed to enforce a legal right or claim, by courts and regulators in their functions, to prevent or investigate offences, for a court-approved merger or demerger, or to find the assets of a loan defaulter (section 17(1)). Security safeguards and responsibility for your processors still apply (section 8(1) and 8(5)).
- The same goes for personal data of people outside India that a business in India processes under a contract with someone outside India (section 17(1)).
- Research, archiving and statistics are outside the Act when the data is not used to decide anything about a person and the prescribed standards are met (section 17(2)).
- The Government may exempt classes of businesses, including startups, from some duties by notification (section 17(3)). No such notification was in MeitY's list of DPDP documents on 28 October 2026.
Questions
Does the DPDP Act apply to small businesses?
Yes. The Act sets no minimum size or turnover. A shop that keeps customers' mobile numbers for a loyalty scheme, or a clinic that keeps patient records on a computer, is a Data Fiduciary.
Does it apply to employee data?
Yes, when it is digital. Section 7(i) allows some processing for employment without consent, but security safeguards, breach intimation and the other duties still apply.
Does it apply to a company outside India?
Yes, when it processes personal data in connection with offering goods or services to people in India (section 3(b)).
What about data collected before the Act?
It is covered. Where consent was given before the Act came into force, the business must send a notice as soon as reasonably practicable (section 5(2)).
Read in the Act, G.S.R. 843(E) and the Rules on 28 October 2026. This is not legal advice.