Who needs to comply with the DPDP Act?

If you collect or use digital personal data of individuals - customers, enquirers, staff, patients, students, subscribers - and you decide why and how, you are likely a Data Fiduciary.

Typically in scope

• Companies, LLPs, partnerships, proprietors and professionals handling customer, patient, student or employee data.
• Websites with contact, enquiry, signup or newsletter forms.
• Overseas businesses offering goods or services to people in India.
• Trusts and NGOs handling donor or beneficiary data.

Possible relaxations

The Act allows exemptions for specified purposes and for classes notified by the Government (for example certain startups). Exemptions are narrow and conditional - confirm current notifications before relying on one.

Not in scope

• Purely personal or domestic use of personal data.
• Data the person made public themselves.

Being a Processor is different

A vendor processing data for another business is a Data Processor. It still needs a valid contract and security, but primary accountability sits with the Data Fiduciary.