Does the DPDP Act Apply to Me?
A few yes or no questions, answered from section 3 of the DPDP Act 2023. Find out whether it applies, in what role, and what starts when.
Last reviewed against the DPDP Act 2023 and the DPDP Rules 2025
Do you handle data about identifiable people?
Customers, users, leads, employees, patients, students. A name, phone number, email or anything else that identifies a person counts.
It applies. What now?
Start with what you hold: which systems store personal data, whose it is, and why you keep it. Every other duty, from the notice to breach reporting, depends on that map.
Privacy Labs finds the personal data in your systems with a scanner that runs on your own machine, then runs consent, requests and breach reporting from one place.
Common questions
Does the DPDP Act apply to small businesses?
Yes. The Act has no size, turnover or user-count threshold. If you process digital personal data in India, or process it abroad while offering goods or services to people in India, it applies.
Are startups exempt from the DPDP Act?
Not today. Section 17(3) lets the government exempt notified classes of startups from certain provisions, but no such notification has been issued.
When do DPDP obligations start?
Most obligations, including notice, consent, security, breach reporting, erasure and the rights of Data Principals, apply from 13 May 2027. On 13 November 2026 only the registration of Consent Managers begins.
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides why and how personal data is processed and carries the duties under the Act. A Data Processor processes data on its behalf, and the Data Fiduciary must bind it by contract.
Does the Act cover paper records?
Only if they are digitised later. Personal data collected on paper and then entered into a system is covered; paper that never becomes digital is not.
Want to know how your website looks to a regulator? Run the free DPDP scanner
See all free DPDP tools