Does DPDP apply to my business? A plain-language starting point
Reviewed by Confidential Dispatch Editorial Team · Updated 29 Oct 2026 · 4 min read
If your business collects any digital personal data from people in India, names, phone numbers, emails, ID documents, customer or employee records, India’s DPDP Act applies to you, whatever your size or sector. It also reaches a business based outside India if it offers goods or services to people in India. The real outs are narrow: data that stays purely on paper and is never digitised, and processing an individual does purely for personal or domestic reasons. Neither describes a running business.
Educational resource only. This gives a plain-language starting point for whether India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your business; it is not formal legal advice.
Does the size of your business matter?
No. There’s no turnover, headcount or revenue threshold in the Act
A solo consultant with a spreadsheet of client emails is covered exactly as a large company is, because the law is triggered by what you do with personal data, not how big you are. Small businesses and solo professionals get no exemption on size alone, only narrow, government-notified relief for specific classes like recognised startups (Section 17), and only on some duties, not all of them.
Does the kind of business you run matter?
No. The Act doesn’t single out any industry, and it isn’t a “tech company” law
A clinic keeping patient records, a coaching class with student contact details, a boutique with a customer list, an agency running client campaigns, all of these decide why and how personal data is used, which is the entire test. If that description fits your business in any form, you’re very likely what the Act calls a Data Fiduciary, and the industry you’re in doesn’t change that.
What if your business is based outside India?
It can still apply to you
The Act reaches processing that happens entirely outside India if it’s connected to offering goods or services to people in India (Section 3), so a foreign SaaS company, an overseas e-commerce store, or a consultancy serving Indian clients from abroad doesn’t get to sit outside the law just by being incorporated elsewhere. If that’s your situation, the rules for foreign companies under the DPDP Act go further into who is caught and what they owe.
Does it apply to paper records too?
Only once that data goes digital
The Act covers digital personal data, including paper records the moment they’re scanned, photographed, or typed into a spreadsheet, CRM or messaging app. Purely paper files that are never digitised sit outside its scope, but for most businesses today that’s the rare exception, not daily practice. If you still keep a lot of paper-only records, where the line between paper and digital falls matters more for you.
What if I’m an individual, not a business?
Processing personal data for a personal or domestic purpose, like your own contacts or family photos, sits outside the Act entirely (Section 3)
This exemption is built for individuals living their lives, not for running a business. The moment a personal activity turns commercial, a side-hustle Instagram shop, a freelance gig with paying clients, even one client, the personal-purpose exemption stops applying, and the ordinary business rules above take over.
So what happens once you know it applies?
Once you know you’re covered, the next question is what role you occupy and what that role requires of you
Most businesses turn out to be Data Fiduciaries, the ones deciding why and how personal data gets used, which carries a specific, learnable set of duties: notice, consent, security, retention limits and honouring people’s rights.
Check your DPDP exposure. The DPDP Exposure Self-Check asks a short set of questions about the data your business collects and how, and gives you a plain-English read on which duties apply to you.
FAQ
I’m a freelancer with just a handful of clients. Does DPDP really apply to me?
Yes, if you hold any of their personal data digitally, phone numbers, emails, invoices with their details. The Act has no minimum scale, so a handful of clients is enough to bring the same core duties into play, just at a proportionate scale.
We’re a foreign company with no office in India. Are we covered?
Potentially, yes, if you offer goods or services to people in India. Location of incorporation doesn’t decide this; who you’re serving does.
We only take customer details on paper forms. Are we exempt?
Only if that data is never digitised in any way, no scanning, no typing it into a system, no photographing it. Most businesses cross that line quickly, so check rather than assume.
Does being a registered startup exempt us?
Not automatically. The government can notify certain classes, including recognised startups, for lighter treatment of specific obligations, but no such exemption is currently in force.
Is this the same as the DPDP Exposure Self-Check?
No, this is the plain-language starting point. The Self-Check tool goes further, walking through your specific data types and practices to show exactly where your obligations sit once you know DPDP applies to you.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 29 October 2026 · Not legal advice.
