Decision aid

Does the DPDP Act apply?

Section 3 says what the Act applies to and what it leaves out. Section 17 then lifts parts of the Act for particular purposes and particular fiduciaries. Answer each step from the facts of your own processing; every step shows the text it rests on.

Step 1

Is the personal data in digital form, or was it collected in non-digital form and digitised afterwards?

Rests on
All steps in this tool

  1. Is the personal data in digital form, or was it collected in non-digital form and digitised afterwards?

    Rests on: Section 3 — Application of Act, Section 2 — Definitions

  2. Where does the processing take place?

    Rests on: Section 3 — Application of Act

  3. The Act does not apply. The Act does not apply: the personal data is not digital.

    Section 3(a) and Section 3(b) reach only the processing of digital personal data: personal data collected in digital form, or collected in non-digital form and digitised subsequently (Section 3(a)(i) and (ii)). Section 2(n) defines digital personal data as personal data in digital form. Personal data that is never digitised is outside what Section 3 brings within the Act. If the same data is later digitised, run this check again from the start.

    Rests on: Section 3 — Application of Act, Section 2 — Definitions

  4. Is the personal data processed by an individual for a personal or domestic purpose?

    Rests on: Section 3 — Application of Act

  5. Is the processing outside India in connection with any activity related to offering goods or services to Data Principals within the territory of India?

    Rests on: Section 3 — Application of Act

  6. The Act does not apply. The Act does not apply: personal or domestic processing by an individual.

    Section 3(c)(i) says the Act does not apply to personal data processed by an individual for any personal or domestic purpose. The exclusion speaks of processing by an individual, so it does not extend to processing by a company, firm or other organisation, however small.

    Rests on: Section 3 — Application of Act

  7. Was the personal data made publicly available by the Data Principal herself, or by another person who is under a legal obligation in India to make it publicly available?

    Rests on: Section 3 — Application of Act

  8. The Act does not apply. The Act does not apply: processing outside India with no connection to offering goods or services in India.

    Section 3(b) is the only limb of Section 3 that reaches processing outside the territory of India, and it does so only where the processing is in connection with any activity related to offering goods or services to Data Principals within India. On these facts that connection is absent, so Section 3 does not bring the processing within the Act. A different situation is covered by Section 17(1)(d): a person based in India who processes the personal data of Data Principals outside India under a contract with a person outside India is within the Act but exempt from most of Chapters II and III.

    Rests on: Section 3 — Application of Act, Section 17 — Exemptions

  9. The Act does not apply. The Act does not apply: personal data made publicly available by the Data Principal or under a legal obligation.

    Section 3(c)(ii) excludes personal data that is made or caused to be made publicly available by (A) the Data Principal to whom it relates, or (B) any other person who is under an obligation under any law in force in India to make it publicly available. The Illustration to Section 3 gives the example of an individual who publicly shares her personal data on social media while blogging her views. Personal data made public by anyone else, without such a legal obligation, is not within this exclusion.

    Rests on: Section 3 — Application of Act

  10. Is the processing either (a) by an instrumentality of the State that the Central Government has notified under Section 17(2)(a), or (b) necessary for research, archiving or statistical purposes, where the personal data will not be used to take any decision specific to a Data Principal and the processing follows the prescribed standards?

    Rests on: Section 17 — Exemptions, Rule 16 — Exemption from Act for research, archiving or statistical purposes, Second Schedule — Second Schedule (see rules 5(1) and 16)

  11. The Act does not apply. The Act does not apply: Section 17(2) exempts this processing entirely.

    Section 3 would bring this processing within the Act, but Section 17(2) says the provisions of the Act shall not apply in respect of it. For an instrumentality of the State the exemption depends on a Central Government notification made in the interests listed in Section 17(2)(a). For research, archiving or statistical purposes it depends on the personal data not being used to take any decision specific to a Data Principal and on the processing following prescribed standards; Rule 16, which applies from 13 May 2027, sets those standards in the Second Schedule. If either condition is not met, go back one step and continue.

    Rests on: Section 3 — Application of Act, Section 17 — Exemptions, Rule 16 — Exemption from Act for research, archiving or statistical purposes, Second Schedule — Second Schedule (see rules 5(1) and 16)

  12. Is the processing for one of the purposes in Section 17(1): enforcing a legal right or claim; by a court, tribunal or a body entrusted by law with a judicial, quasi-judicial, regulatory or supervisory function, where necessary for that function; the prevention, detection, investigation or prosecution of an offence or contravention of Indian law; personal data of Data Principals outside India processed by a person based in India under a contract with a person outside India; a court-approved merger, amalgamation, demerger or similar scheme; or ascertaining the financial information, assets and liabilities of a defaulter on a loan from a financial institution?

    Rests on: Section 17 — Exemptions

  13. The Act applies with exemptions. The Act applies with exemptions: most of Chapters II and III, and Section 16, do not apply to this processing.

    Section 3 brings the processing within the Act, but for the purposes listed in Section 17(1) the provisions of Chapter II (except sub-sections (1) and (5) of Section 8), Chapter III and Section 16 do not apply. Chapter II carries the obligations of Data Fiduciaries, Chapter III the rights and duties of Data Principals, and Section 16 the Central Government's power to restrict transfers outside India. Two obligations survive in Chapter II: Section 8(1), which keeps the Data Fiduciary responsible for complying with the Act in respect of processing done by it or by its Data Processor, and Section 8(5), which requires reasonable security safeguards to prevent personal data breach. The rest of the Act, including the Board, penalties and the Schedule, continues to apply.

    Rests on: Section 3 — Application of Act, Section 17 — Exemptions, Section 8 — General obligations of Data Fiduciary, Section 16 — Processing of personal data outside India, The Schedule — The Schedule — Penalties (see section 33)

  14. Has the Central Government notified you — individually or as part of a class of Data Fiduciaries, such as recognised startups — under Section 17(3) as a Data Fiduciary to whom Section 5, sub-sections (3) and (7) of Section 8, and Sections 10 and 11 do not apply?

    Rests on: Section 17 — Exemptions, Section 5 — Notice, Section 8 — General obligations of Data Fiduciary, Section 10 — Additional obligations of Significant Data Fiduciary, Section 11 — Right to access information about personal data

  15. The Act applies with exemptions. The Act applies with exemptions: a Section 17(3) notification lifts Sections 5, 8(3), 8(7), 10 and 11.

    Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or classes of Data Fiduciaries, including startups, as fiduciaries to whom Section 5 (notice), sub-sections (3) and (7) of Section 8 (accuracy of data used for decisions or disclosed, and erasure), Section 10 (Significant Data Fiduciary obligations) and Section 11 (right to access information) do not apply. Everything else in the Act, including consent under Section 6 and the remaining obligations in Section 8, still applies. The exemption exists only if the notification names you or your class; nobody can assume it.

    Rests on: Section 3 — Application of Act, Section 17 — Exemptions, Section 5 — Notice, Section 6 — Consent, Section 8 — General obligations of Data Fiduciary, Section 10 — Additional obligations of Significant Data Fiduciary, Section 11 — Right to access information about personal data

  16. The Act applies. The Act applies.

    On these facts Section 3 brings the processing within the Act: it is the processing of digital personal data within India, or outside India in connection with offering goods or services to Data Principals in India, and neither exclusion in Section 3(c) is met. None of the exemptions in Section 17 you were asked about applies. Two further routes in Section 17 depend on who you are: Section 17(4) narrows specific provisions for processing by the State or its instrumentalities, and Section 17(5) lets the Central Government, within five years of commencement, declare by notification that a provision does not apply to a Data Fiduciary or class for a specified period. Start with the grounds for processing in Section 4.

    Rests on: Section 3 — Application of Act, Section 17 — Exemptions, Section 4 — Grounds for processing personal data