DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · DPDP Act 2023

Who the DPDP Act applies to — and who it doesn't

Section 3 sets the boundaries: Indian digital personal data, data processed abroad for Indian users, and the two main exemptions.

Educational only · not legal adviceReviewed by Sandesh Kokate, Editor

In plain English

The DPDP Act covers digital personal data about people in India. This applies whether the data was digital from the start, or started on paper and was later scanned or typed into a system. It also reaches processing done overseas. That happens if the processing is tied to offering goods or services to Indian Data Principals.

Two big carve-outs exist:

  • Personal or domestic use by an individual — for example, a diary, household contacts, or family chat.
  • Personal data that is already publicly available, because the data subject (or someone legally required to publish it) put it out in the open.

Think of it like

A city traffic law applies to every vehicle on its roads. This includes delivery vans from another city that come in to serve local customers. But it does not apply to a parent driving their own child to school. It also does not apply to a number plate the owner already displayed on a public notice board.

Key takeaways

  • The Act treats collection the same way whether it is digital at source, or non-digital and later digitised.
  • Overseas processing is covered when it is connected with offering goods or services to people in India.
  • Personal or domestic use by an individual is outside the Act.
  • Data the data subject already made public, or that someone was legally required to publish, is also outside the Act.
  • The Act is on the statute book now. Core obligations become enforceable on 13 May 2027.

What this means for you

Founders

Does your product collect, digitise, or process personal data of Indian users to offer goods or services? Then the Act applies to you. That is true even if your servers are abroad.

Freelancers

Processing client data for a business purpose is not a personal or domestic exemption. Know whether you act as a Data Fiduciary or a Data Processor.

Creators

Personal blogging and household use are exempt. But once you collect audience emails, run a paid newsletter, or sell merchandise in India, the exemption no longer covers that data.

Status

EnforceableCore obligations become enforceable on 13 May 2027. The Act has been on the statute book since 13 November 2025. The Data Protection Board is not yet hearing complaints.

Primary sources

Quick self-check

Am I a Data Fiduciary?

Run the 3-minute self-check to see whether Section 3 puts your product inside the DPDP Act's scope.

Run it now
Official text — Section 3, DPDP Act, 2023
SECTION 3 — Application of Act (DPDP Act, 2023) 3. Subject to the provisions of this Act, it shall— (a) apply to the processing of digital personal data within the territory of India where the personal data is collected–– (i) in digital form; or (ii) in non-digital form and digitised subsequently; (b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India; (c) not apply to— (i) personal data processed by an individual for any personal or domestic purpose; and (ii) personal data that is made or caused to be made publicly available by— (A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available. Illustration. X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

Citation

Kokate, S. (2026). Who the DPDP Act applies to — and who it doesn't. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/who-dpdp-applies-to. Educational content, not legal advice.

← Back to Data Privacy hubData Principal rights →

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.