Does the DPDP Act Apply to You? A 5-Minute Scope Test

Who this is for: founders, business heads and legal teams who need a fast, defensible answer to the first question in any DPDP programme: are we in scope, and how far?

Most organisations assume one of two things about India's Digital Personal Data Protection Act: that it only applies to large technology companies, or that it applies to everything in exactly the same way. Neither is right. The Act has a very wide scope, but its obligations scale with the role you play, the data you handle and whether the government designates you as significant.

Work through the seven questions below in order. Each one cites the provision it rests on, so you can share the result with your board or counsel. For the full picture of what the law requires once you are in scope, read The DPDP Act, Explained: The Complete 2026 Guide.

Question 1: Do you process personal data?

Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to that data. "Processing" is equally broad. It covers collection, recording, storage, use, sharing, disclosure and erasure, whether automated or partly automated.

You almost certainly do if you hold any of the following:

• customer and prospect records: names, phone numbers, email addresses, addresses
• employee, contractor and job applicant files
• B2B contacts: the names and business email addresses of people at client and vendor companies
• device identifiers, IP addresses, cookie IDs and app analytics linked to a user
• CCTV footage, visitor logs and access-card records stored digitally
• call recordings, chat transcripts and support tickets

You may be outside this question only if your data is genuinely anonymised, meaning no individual can be identified from it, alone or combined with other information you hold. Pseudonymised data, such as records keyed to a customer ID, is still personal data.

Question 2: Is the data digital?

Under Section 3(a), the Act applies to personal data collected in digital form, and to personal data collected in non-digital form that is digitised later.

A paper visitor register that is never scanned falls outside the Act. The moment it is scanned, typed into a spreadsheet or photographed onto a shared drive, it is in scope. In practice, very little business data stays purely on paper.

Question 3: Is there a link to India?

The Act applies to processing within India (Section 3(a)), regardless of the nationality of the people whose data it is, subject to the outsourcing exemption in Question 5.

It also applies to processing outside India if it is connected with any activity related to offering goods or services to Data Principals within India (Section 3(b)). A SaaS company in Singapore with Indian customers, or a US e-commerce site that ships to India, is in scope for the data of those Indian customers.

Unlike the GDPR, the final DPDP Act does not extend extraterritorial reach to profiling or monitoring of individuals in India on its own. The trigger is offering goods or services.

Question 4: Does an exclusion take you out entirely?

Section 3(c) excludes two categories from the Act altogether:

1. Personal or domestic purposes. Personal data processed by an individual for any personal or domestic purpose, such as a family contact list or personal photo album. This never applies to a business.
2. Data made publicly available by the individual or under a legal obligation. Personal data that the individual has made public themselves, or caused to be made public, or that someone is legally obliged to publish. The Act's illustration is a blogger who shares her own personal data on social media.

Be careful with the second exclusion. It does not cover all data that happens to be visible online. Personal data published by someone else, scraped from a leaked database, or posted by a third party about an individual is still within the Act.

Question 5: Does a Section 17 exemption apply?

Section 17 exempts certain processing from most of the Act's obligations. The main exemptions in Section 17(1) cover processing that is necessary:

• to enforce a legal right or claim
• by courts, tribunals and bodies performing judicial, quasi-judicial, regulatory or supervisory functions
• to prevent, detect, investigate or prosecute any offence
• for personal data of individuals outside India, processed in India under a contract with a person outside India (the "outsourcing exemption", important for IT services and BPO companies)
• for a court- or tribunal-approved merger, demerger, amalgamation or similar scheme
• to ascertain the financial information and assets of a person who has defaulted on a loan

Section 17(2)(b) also exempts research, archiving and statistical purposes, provided the data is not used to take decisions about a specific individual and the standards prescribed in the Rules are met.

Two points matter in practice. First, these exemptions are partial. Even exempt processing under Section 17(1) remains subject to Section 8(1), which makes the fiduciary responsible for compliance, and Section 8(5), which requires reasonable security safeguards. Second, they apply to specific processing activities, not to whole organisations. A bank pursuing a loan default can rely on the exemption for that activity, while its marketing database remains fully in scope.

What about startups? Section 17(3) lets the government exempt notified classes of Data Fiduciaries, including startups, from specific obligations such as notice and erasure. No such notification had been issued at the time of writing. Do not assume an exemption that does not yet exist.

Question 6: Which role do you play?

If you are still in scope, your obligations depend on your role in each processing activity:

Most organisations are both. A payroll provider is a fiduciary for its own employees' data and a processor for its clients' employee data. Map the role per activity, not per company.

Question 7: How heavy are your obligations?

Three factors raise the bar significantly:

• Children's data. If any of your users may be under 18, Section 9 requires verifiable parental consent and bans tracking, behavioural monitoring and targeted advertising directed at children. Edtech, gaming, social and consumer apps are most exposed.
• Significant Data Fiduciary designation. Under Section 10, the government can designate fiduciaries based on the volume and sensitivity of data processed and the risk to individuals, the state and public order. SDFs must appoint a Data Protection Officer based in India, an independent data auditor, and run annual impact assessments and audits.
• Large-platform retention rules. E-commerce and social media intermediaries with two crore or more registered users in India, and online gaming intermediaries with fifty lakh or more, must erase data after three years of user inactivity under the Third Schedule to the Rules.

Your result

For the dates that apply to you, see the DPDP compliance timeline.

What to do next

If you are in scope, three actions come first:

1. Map your processing activities. List what personal data you hold, why, in which systems, shared with whom and for how long. This record tells you your role, your lawful basis and your risk for each activity.
2. Check your consent. Most existing consent flows will not meet the Section 6 standard. Our guide to valid consent under DPDP explains the six tests.
3. Assess designation risk. If you process large volumes of financial, health or children's data, prepare as if you will be designated a Significant Data Fiduciary.

How ConsentifyAI helps

Answering the scope question properly means knowing what personal data you actually hold. ConsentifyAI's ROPA module gives you a structured Record of Processing Activities: every purpose, data category, system, vendor, lawful basis and retention period in one place. It shows exactly which activities are in scope, which rely on an exemption, and where your obligations are heaviest. It also becomes the foundation for your notices, consent and rights processes.