Facts to collect
Describe each important activity in ordinary business terms, then record the personal data, whether it is digital or digitised, where processing happens and who decides its purpose.
- Include customers, applicants, employees and other people, not only paying customers.
- Separate your own activities from work performed on a client’s instructions.
The legal starting point
Section 3 addresses digital personal data processed in India and certain processing outside India linked to offering goods or services to people in India. Exclusions and exemptions need a factual review.
A useful next decision
If the scope is unclear, request a bounded applicability review. An unknown answer in the assessment means more information is needed; it is not a conclusion that the activity is outside the law.
Timing matters
The commencement notification places provisions into different phases. Check the applicable tranche alongside any requirements already relevant to the business.
Gazette: DPDP Act commencement notification, 13 November 2025
Common questions
Is headcount the applicability test?
No. Start with the actual activities and relevant legal scope.
Can an overseas company dismiss India scope?
Its location alone does not settle the question. Review the connection between its processing and people in India.
Discuss the work you need
Agree the service, deliverables, responsibilities and fees before committing to an engagement.
Related reading
References
- MeitY: Digital Personal Data Protection Act, 2023
- Gazette: DPDP Act commencement notification, 13 November 2025
This page explains topics to scope and discuss. It does not establish applicability, certify compliance or confirm a paid engagement.
← Decision guides