Does the DPDP Act apply to you?
Six questions, answered in your browser. This is a structured reading of Sec 3 to tell you where to look. It is not legal advice, and it does not account for sector regulation that may sit on top.
- 01
Do you handle data about identifiable individuals?
Names, emails, phone numbers, device identifiers, order histories, employee records: anything by which a person can be identified.
Sec 2(t) - 02
Is any of it in digital form, or non-digital data you later digitise?
The Act covers digital personal data, plus paper records that are subsequently digitised. Purely paper records that stay on paper are outside it.
Sec 3(a) - 03
Does that processing happen within India?
Answer yes if any collection, storage or use occurs in India, regardless of where your company is incorporated.
Sec 3(a) - 04
Is all of this purely personal or domestic, with no business use whatsoever?
A personal contacts list is exempt. A sole proprietor's customer list is not.
Sec 3(c)(i) - 05
Is the personal data one you are legally required to make publicly available?
For example, disclosures a statute obliges you to publish. This is narrow, so do not read it as covering data that happens to be public.
Sec 3(c)(ii)