One of the most common questions about the DPDP Act is also the simplest: does it apply to my organisation? For most, the answer is yes. Here's how to tell.
The general rule
The DPDP Act applies to the processing of digital personal data within India — and to processing outside India where it relates to offering goods or services to people in India. There is no "too small" exemption: a sole proprietor with a customer list has duties under the Act, just fewer than a bank.
So, who's covered?
- Startups and SMEs holding customer or user data
- Hospitals, clinics and labs with patient records
- Schools, colleges and edtech platforms (with extra care for children's data)
- NBFCs, fintechs and banks
- E-commerce, SaaS, logistics, travel, media — essentially any business with personal data
- Employers, for their employee data
What about B2B data?
The Act protects the personal data of individuals. Business contact details still identify a person, so most B2B datasets contain personal data and fall within scope.
The limited exemptions
Some processing is exempt or lightly regulated — for example, purely personal or domestic use, certain state functions, and data a person has themselves made publicly available. These are narrow; most commercial processing is fully in scope.
Are you a Significant Data Fiduciary?
The government can notify larger or higher-risk fiduciaries as SDFs, based on data volume, sensitivity, risk to individuals and cross-border transfer. SDFs carry heavier duties — a resident DPO, Data Protection Impact Assessments, and periodic independent audits.
How to tell which side of the line you're on
If you process personal data, you must comply — the only question is how much. The quickest way to find out your classification and obligations is a short assessment: ours takes about ten minutes and returns a directional SDF answer, with the full picture in a detailed gap report.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.