Who the DPDP Act applies to

Processing within India

The Act covers personal data processed within India where the data is collected in digital form, or collected on paper and digitised later. Personal data is any data about an individual who can be identified by or in relation to that data.

A lender that takes loan applications through an app is covered. So is a hospital chain that scans paper admission forms into its hospital information system. Paper records that are never digitised fall outside the Act.

Processing outside India

The Act also applies to processing outside India if it is in connection with any activity related to offering goods or services to Data Principals within India. A D2C brand run from Singapore that ships to customers in Pune, or a foreign edtech platform that enrols students in Kerala, should plan on the Act applying to that processing.

Where the processing sits matters less than whom the goods or services are offered to.

What the Act leaves out

Section 3 excludes two kinds of processing from the Act altogether.

• Personal data processed by an individual for a personal or domestic purpose, such as a family WhatsApp group or a personal phone contact list
• Personal data that the Data Principal has made, or caused to be made, publicly available
• Personal data made publicly available by another person who is under a legal obligation to publish it

Exemptions are a separate question

Section 17 exempts certain processing from some of the Act's duties, for example processing needed to enforce a legal right or claim, or processing for the prevention, detection or investigation of offences. Some exemptions are partial and come with conditions, so they need careful reading.

An organisation in India that processes data of people outside India under a contract with a foreign client, such as a back office or a capability centre, should look at section 17(1)(d) with counsel. It exempts that processing from many of the duties, while the duty to keep reasonable security safeguards still applies.

Your role: fiduciary or processor

The Act places most duties on the Data Fiduciary, the organisation that decides the purpose and means of processing. A Data Processor processes data on its behalf. A payroll provider working for a school is a processor for that payroll, and a Data Fiduciary for its own staff data.

Mapping which role you hold for each data set is the first practical step, because the duties follow the role.

How TrustOS helps

The data inventory records each system and data set, where it is processed, whose data it holds and whether you act as fiduciary or processor for it. Purposes are linked to each record, so you can see which processing is in scope and which you have treated as excluded or exempt, with the reasoning written down.

TrustOS does not decide whether an exclusion or exemption applies to you. That call stays with your legal counsel, and TrustOS does not replace legal advice.