The first DPDP question every organisation asks is “does this even apply to us?” For most, the answer is yes. This guide explains the Act's scope — who's covered, whether foreign companies and small businesses are in, and what's exempt. Part of our guide to the DPDP Act.
The DPDP Act applies to the processing of digital personal data — personal data in digital form, or non-digital data that is later digitised — where that processing happens in India, or happens outside India but is connected to offering goods or services to individuals in India. Purely offline, non-digital records are outside its scope.
Yes. The Act applies extraterritorially: a company based anywhere in the world is covered if it processes the personal data of individuals in India in connection with offering them goods or services. A SaaS company serving Indian users, or an AI vendor whose product processes Indian users' data, is in scope wherever it is headquartered.
Yes — the Act applies regardless of company size. The government may, by notification, exempt or relax certain obligations for startups and smaller Data Fiduciaries, but the core duties around consent, security and Data Principal rights still apply. Assuming you're too small to be covered is a risky bet.
Some processing sits outside the Act, including: personal data processed for purely personal or domestic purposes; certain processing by the State for specified functions such as national security and law enforcement; and processing for research, archiving or statistical purposes, subject to safeguards. Exemptions are specific — don't assume one applies without checking.
If you're notified as an SDF, you must additionally appoint an India-based Data Protection Officer, conduct Data Protection Impact Assessments, and commission independent audits — obligations that begin biting in the 2027 phase of enforcement.
A quick test: do you process any personal data of people in India, in digital form, as part of running your business? If yes — and for almost every organisation the answer is yes — you're a Data Fiduciary with obligations under the DPDP Act. The next step is the DPDP compliance checklist.
AramGRC helps you determine your exact role and obligations under the DPDP Act — Data Fiduciary or SDF, in-scope systems and exemptions — and builds the compliance roadmap that follows.
If you process the digital personal data of people in India as part of your business, yes — you're a Data Fiduciary with obligations under the Act, regardless of size.
Yes — it applies extraterritorially to any organisation processing the personal data of people in India in connection with offering goods or services to them.
No — it applies regardless of size, though the government may relax some obligations for startups and small entities by notification. Core duties still apply.
A Data Fiduciary the government notifies as significant based on data volume and sensitivity and risk — subject to extra obligations like a Data Protection Officer, DPIAs and audits.
Purely personal or domestic processing, certain State functions such as national security and law enforcement, and research, archiving or statistical processing subject to safeguards.
What India's Digital Personal Data Protection Act is, what it requires, and how to comply.
What the notified DPDP Rules 2025 require and the phased timeline.
A step-by-step checklist to become DPDP-compliant.
Fines up to ₹250 crore — the full penalty schedule and enforcement.
Scope, who's covered, exemptions, and key roles.
You're here
Is the DPDP Act in force? The phased dates to 2027.
How India regulates AI: DPDP, MeitY guidelines, RBI FREE-AI and sector rules.