When Does the DPDP Act Apply?
Understanding the Applicability of the Digital Personal Data Protection Act, 2023 — Section 3.
Before Compliance, Comes Applicability
Before an organization can plan privacy policies, appoint a Data Protection Officer, or implement consent mechanisms, it must answer one foundational question: Does the DPDP Act even apply to us?
Getting this wrong — in either direction — creates real risk. Assuming the Act does not apply when it does exposes organizations to regulatory action. Assuming it always applies wastes time and resources on unnecessary compliance.
Step 1
Determine if your data processing activities fall within the scope of the Act.
Step 2
Understand the exceptions — where the Act explicitly does not apply.
Step 3
Then — and only then — plan your compliance roadmap.
What Kind of Data Does the Act Cover?
The DPDP Act, 2023 applies specifically to digital personal data — not all data, and not all personal data. Understanding this boundary is essential.
Personal Data Collected Digitally
Any personal data that is collected, stored, or processed in digital form from the outset — such as data entered in an online form, mobile app, or digital system.
Physical Data That Is Later Digitized
Personal data originally collected on paper or in physical form, but subsequently converted into digital format — for example, scanning a handwritten form and storing it electronically.
Where Does the Act Apply?
The territorial scope of the DPDP Act is broader than many organizations realize. It is not limited to Indian companies alone — it follows the data subject, not the location of the business.
This means a foreign company offering a subscription service, an app, or an e-commerce platform to users in India must comply with the DPDP Act — even if it has no office or server in India.
The Act in Action — Sector by Sector
The DPDP Act touches virtually every sector that processes personal information digitally. Here are four key industries and the data processing activities that fall within its scope.
🏥 Healthcare
- Patient data in Hospital Information Systems (HIS)
- Online appointment booking portals
- Electronic Medical Records (EMR)
🏦 Banking
- Mobile banking and internet banking platforms
- Digital KYC processes
- Online account opening and transactions
👔 Human Resources
- Employee records stored in HRMS platforms
- Payroll processing software
- Digital attendance and leave management systems
🛒 E-Commerce
- Customer registration and profile creation
- Online order processing and delivery tracking
- Digital payment and transaction records
When Does the DPDP Act NOT Apply?
The Act carves out two key exceptions. Understanding these helps individuals and organizations avoid unnecessary compliance burdens for genuinely personal or publicly available data.
Exception 1: Personal or Domestic Use
Personal data processed by an individual for purely personal or domestic purposes is excluded from the Act.
Examples:
- A family photo album stored on your phone
- A personal diary or journal maintained digitally
- Contact lists used for personal communication
- Home videos shared only within the family
Exception 2: Publicly Available Personal Data
Personal data that has been made publicly available by the individual themselves — or under any obligation imposed by Indian law — is excluded.
Examples:
- A name and designation published on an official government website
- Information voluntarily shared in a public social media post
- Statutory disclosures required under company law or RTI
Does the DPDP Act Apply? — A Decision Tree
Use this simple step-by-step flow to determine whether a given data processing activity falls within the scope of the DPDP Act, 2023.
1. Is it personal data?
Does the information relate to an identifiable individual?
2. Is it digital?
Was it collected digitally or digitized from a physical record?
3. Is there an exception?
Check personal/domestic use and publicly available data exceptions.
Does the Act Apply? — Test Your Understanding
Let’s apply the decision framework to five practical everyday scenarios across different contexts.
1. Patient Records in a Hospital
✅ Yes, Act Applies. Medical records stored in HIS or EMR are digital personal data processed by an organization. Clear applicability.
2. Employee Data in HR Software
✅ Yes, Act Applies. HRMS platforms store identifiable employee data digitally. Payroll, attendance, and performance records all qualify.
3. Handwritten Notes Never Digitized
❌ No, Act Does Not Apply. Purely physical records that are never converted to digital form are outside scope.
4. Family Photo Album at Home
❌ No, Act Does Not Apply. Photos maintained for personal or domestic use fall under the personal/domestic exception.
5. Customer Data via a Mobile App
✅ Yes, Act Applies. Mobile apps collecting data from users in India are within scope — even if the company is overseas.
Myths About the DPDP Act — Busted
❌ “It applies to every type of data.”
The Act applies specifically to digital personal data. Non-personal or purely physical data is not covered.
❌ “Only IT companies need to comply.”
Any organization — hospital, school, retailer, manufacturer, or NGO — that processes digital personal data is potentially subject to the Act.
❌ “Small businesses are exempt.”
The Act does not automatically exempt businesses based on size. Even a small shop collecting customer data via WhatsApp or a billing app may fall within its scope.
❌ “Only online businesses process digital data.”
Offline businesses using CCTV systems, attendance apps, payroll software, or scanned forms also process digital personal data.
What Should Every Organization Do First?
Applicability assessment is the starting point of every privacy and compliance programme. Organizations that skip this step often build compliance frameworks on incorrect assumptions.
Map Your Personal Data
Identify what personal data your organization collects, processes, stores, or shares — across departments, systems, and workflows.
Confirm It Is Digital
Determine whether the data exists in digital form — either collected digitally or converted from physical records into electronic format.
Identify Where It Is Stored and Processed
Understand whether processing happens within India or involves offering services to individuals located in India — even if the server is abroad.
Assess Applicability Formally
Apply the decision framework to each processing activity. Document the assessment. Only then build your compliance roadmap.
Quick Reference: Scope of the DPDP Act
Use this comparison table as a ready reckoner to assess whether a given data processing scenario is within the scope of the DPDP Act, 2023.
| Scenario | ✅ Applies | ❌ Does Not Apply |
|---|---|---|
| Patient records in hospital HIS / EMR | Yes — digital personal data processed by an organization | — |
| Employee data in HRMS / payroll software | Yes — identifiable employee data processed digitally | — |
| Customer data via mobile app or website | Yes — digital collection for goods/services | — |
| Handwritten notes never scanned or digitized | — | No — purely physical, not digital personal data |
| Personal family photo album on personal phone | — | No — personal/domestic use exception applies |
| Name published on official government portal | — | No — publicly available data exception applies |
| Foreign app offering services to Indian users | Yes — extra-territorial application covers this | — |
| Digital attendance system at a small office | Yes — size of business is not an exemption criterion | — |
What You Need to Remember
Focus Is on Digital Personal Data
The Act covers personal data in digital form — whether collected digitally or digitized from physical records.
Territorial Scope Is Wide
It applies to processing in India and to entities outside India offering goods or services to individuals in India.
Two Key Exceptions Exist
Personal/domestic use and publicly available data are the two explicit exceptions. Assess carefully before assuming an exemption applies.
Applicability First, Compliance Second
Every organization must assess applicability before building a compliance framework.
What is Personal Data?
DPDP Act 2023 Series · Module 2 → DPDP #04 - What is Personal Data?
Disclaimer
This presentation is intended solely for educational and professional awareness purposes. It provides a general overview of the subject matter discussed. While every effort has been made to ensure the accuracy of the information presented, the content should be read in conjunction with the applicable laws, rules, regulations, official guidance, and judicial developments. The application of law and professional practices may vary depending on the specific facts and circumstances of each case.