Who the DPDP Act applies to: ten scope myths, checked against the text

The DPDP Act applies to any person that decides why and how digital personal data is processed: a company, a firm, an LLP or a sole proprietor. Section 2(i) of the Digital Personal Data Protection Act, 2023 calls that person a Data Fiduciary, and it sets no size, sector or B2B test. Most of the duties apply from 13 May 2027 (Rule 1(4) of the DPDP Rules, 2025). The real limits on scope are narrower than most commentary suggests: data that never leaves paper, personal and domestic use, some publicly available data, and exemptions the Central Government has to notify first.

Part of the DPDPA checklist for small companies. Below are ten common myths about who the Act covers, each with what the text says and what a 5–200 person company should do.

Which DPDP Act scope myths are most common?

#	Myth	Verdict	Provision
1	Startups and MSMEs are exempt	False. A startup exemption needs a notification, and would lift only five provisions	S.17(3)
2	It only applies to large companies	False. “Any person”; size tests exist only for a few extra duties	S.2(i), S.2(s)
3	B2B companies don’t need to comply	False. The people at your customers and suppliers are Data Principals	S.2(t)
4	Employees’ data doesn’t count	False. Consent isn’t needed for employment, but the other duties apply	S.7(i)
5	Paper records are out of scope	Half true. Only until they are digitised	S.3(a)
6	SOC 2 or ISO 27001 means we’re covered	False. No certification is recognised, and security is one duty of many	Rule 6, S.5–S.14
7	Nothing to do until 2027	False. The deadline is 2027; the preparation isn’t	Rule 1, S.5(2)
8	Publicly available data is free to use	Only if the person, or a law, made it public	S.3(c)(ii)
9	We only handle foreign clients’ data	Partly true. Safeguards still apply	S.17(1)(d)
10	We’re outside India, so it can’t reach us	False if you offer goods or services to people in India	S.3(b)

Size tests in the text, by the numbers. The Act and the Rules contain 4 numeric size tests, and none of them decides whether the DPDP Act applies. Three are registered-user counts in the Third Schedule (two crore for e-commerce and social media, fifty lakh for online gaming), which only switch on the inactivity-erasure duty in Rule 8(1). The fourth is the ₹2 crore net-worth floor for Consent Managers (First Schedule, Part A, item 4). The words “MSME”, “small”, “turnover” and “threshold” appear 0 times in either text, and “startup” appears 3 times, all in S.17(3) and its Explanation. Method: case-insensitive search on 25 October 2026 of our verbatim transcriptions of the Act (India Code, as on 19 November 2025) and the Rules (G.S.R. 846(E) as corrected by G.S.R. 892(E)), for numbers written as “crore” or “lakh” and for the listed words. Penalty ceilings in the Schedule and Board salaries in the Fifth Schedule were left out, because they are not tests of who is covered.

Myth 1: “Startups and MSMEs are exempt”

What the Act says. It gives the government a power to exempt; it does not exempt anyone by itself.

The Central Government may, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including startups, as Data Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply.

— Digital Personal Data Protection Act, 2023, Section 17(3)

A startup exemption exists only once a notification is published in the Official Gazette (S.2(r)). Even then it lifts five things: notice (S.5), accuracy when data is used for decisions or shared (S.8(3)), erasure (S.8(7)), the Significant Data Fiduciary duties (S.10) and the right of access (S.11). Consent (S.6), security safeguards (S.8(5)), personal data breach intimation (S.8(6)), children’s data (S.9) and grievance redressal (S.8(10)) stay. “Startup” also has a narrow meaning: an Indian private limited company, partnership firm or LLP “recognised as such” under the government’s startup criteria (Explanation to S.17(3)). MSMEs are not mentioned anywhere. Section 17 itself comes into force on 13 May 2027, with the rest of the core duties (G.S.R. 843(E)). S.17(5) is a second, separate power to switch off any provision for notified classes for a set period, available before five years from commencement.

What to do. Plan to comply in full. Check the Gazette for any notification under S.17(3) or S.17(5) before relying on one, and read exactly which class and provisions it names.

Myth 2: “It only applies to large companies”

What the Act says.

“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;

— Digital Personal Data Protection Act, 2023, Section 2(i)

“Person” includes an individual, a firm, a company and an association of persons (S.2(s)). There is no headcount or revenue line. Size matters in three narrower places: the government may notify a Significant Data Fiduciary after weighing factors such as “the volume and sensitivity of personal data processed” (S.10(1)(a)); the inactivity-erasure duty applies only to the very large platforms in the Third Schedule (Rule 8(1)); and when setting a penalty, the Board must weigh “the likely impact of the imposition of the monetary penalty on the person” (S.33(2)(g)).

What to do. Assume the baseline duties apply to you. The Significant Data Fiduciary duties (a DPO, a DPIA, an independent data audit) do not, unless you are notified. The checklist separates the two.

Myth 3: “B2B companies don’t need to comply”

What the Act says.

“personal data” means any data about an individual who is identifiable by or in relation to such data;

— Digital Personal Data Protection Act, 2023, Section 2(t)

A buyer’s name, work email and mobile number in your CRM are data about an identifiable individual, whatever the deal. The Act has no exemption for business contact details. A B2B company is also a Data Fiduciary for its own staff, leads and website visitors. Where you process your customers’ end-user data for them, you are usually their Data Processor (S.2(k)): the Act places the duties on your customer, who may engage you “only under a valid contract” (S.8(2)) and stays responsible for what you do (S.8(1)). Expect that contract to pass the security clauses Rule 6(1)(f) asks for on to you.

What to do. List the personal data you decide about (staff, contacts, leads) and treat it as yours. For data you handle for customers, get the processor contract right; the SOC 2 and DPDPA guide covers what SaaS buyers ask for.

Myth 4: “Employees’ data doesn’t count”

What the Act says. Employees are Data Principals: “the individual to whom the personal data relates” (S.2(j)). What the Act changes is the ground for processing, not whether it applies:

for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.

— Digital Personal Data Protection Act, 2023, Section 7(i)

So payroll, attendance and HR records need no consent. Security safeguards (S.8(5)), personal data breach intimation (S.8(6)), grievance redressal (S.8(10)) and your payroll vendor’s contract (S.8(2)) still apply. The access and correction rights in S.11 and S.12 are framed around data given with consent, “including consent as referred to in clause (a) of section 7”, so how they apply to data processed only under S.7(i) is a question for your lawyer.

What to do. Write down which HR processing runs under S.7(i), and get consent for anything outside employment purposes. A leaked salary sheet is a personal data breach like any other: see breach intimation.

Myth 5: “Paper records are out of scope”

What the Act says. This one is half true.

Subject to the provisions of this Act, it shall—

(a) apply to the processing of digital personal data within the territory of India where the personal data is collected—

(i) in digital form; or

(ii) in non-digital form and digitised subsequently;

— Digital Personal Data Protection Act, 2023, Section 3(a)

“Processing” is defined as an operation “performed on digital personal data” (S.2(x)). A paper register that stays in a cabinet is outside the Act. The moment it is scanned, photographed onto a shared drive or typed into a spreadsheet, the digital copy is in scope, and S.3(a)(ii) says so in terms.

What to do. Find the paper flows that end up on a computer: visitor books, KYC forms, job applications, delivery slips. Treat them as digital from the point of capture, because that is where the duties start.

Myth 6: “We have SOC 2 or ISO 27001, so we’re covered”

What the Rules say. Neither the Act nor the Rules mention SOC 2, ISO 27001 or any certification for a Data Fiduciary. The only independent certification in the texts is for Consent Managers (First Schedule, Part A, item 9). Rule 6 sets its own minimum:

A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum,—

— Digital Personal Data Protection Rules, 2025, Rule 6(1)

A security programme helps with Rule 6, but check the specifics: logs and the related personal data kept for one year (Rule 6(1)(e)), and security clauses in every processor contract (Rule 6(1)(f)). Most of the Act is not about security at all: notice (S.5), consent and easy withdrawal (S.6), erasure (S.8(7)), a published contact person (S.8(9)), children’s data (S.9), and access, correction, grievances and nomination (S.11–S.14).

What to do. Map your certified controls against Rule 6(1)(a)–(g), then list the non-security duties separately. The ISO 27001 mapping guide does the first half.

Myth 7: “It doesn’t apply until 2027, so there’s nothing to do now”

What the Rules say. The date is right; the conclusion isn’t.

(3) Rule 4 shall come into force one year after the date of publication in the Official Gazette.

(4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.

— Digital Personal Data Protection Rules, 2025, Rule 1

With publication on 13 November 2025, Consent Manager registration opens on 13 November 2026 and the core duties apply from 13 May 2027. The definitions and the sections setting up the Board (ss. 18–26) have been in force since 13 November 2025; the Board’s powers and procedure (ss. 27–28) start on 13 May 2027. Until 13 May 2027, section 43A of the IT Act, 2000 stays in place; the DPDP Act omits it only from that date (S.44(2)). Three things take longer than people expect:

• Your existing customers. For consent given before commencement, you must send a notice “as soon as it is reasonably practicable” (S.5(2)(a)). That means knowing what you hold and on what basis.
• One-year logs. Rule 6(1)(e) and Rule 8(3) require logs and related personal data kept for at least a year. Logging has to be running on day one.
• Vendor contracts. Every processor needs a valid contract with security clauses (S.8(2), Rule 6(1)(f)). Renewal cycles are slow.

What to do. Use the months before May 2027 for the inventory, the logging and the contracts.

Myth 8: “Publicly available data is free to use”

What the Act says. The carve-out depends on who made the data public:

(ii) personal data that is made or caused to be made publicly available by—

(A) the Data Principal to whom such personal data relates; or

(B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

— Digital Personal Data Protection Act, 2023, Section 3(c)(ii)

The Act’s own example is a person blogging her views on social media. A profile someone posted about themselves is outside the Act; a lead list compiled by a third party from directories and forums is not covered by this carve-out unless each person made their data public, or a law required it. The Act does not define “made publicly available”, so keep records of the source.

What to do. Record where every bought or scraped dataset came from. If you can’t show the person published it, treat it as in scope.

Myth 9: “We only process foreign clients’ data, so the Act doesn’t apply”

What the Act says. This is partly true, and it is the most useful exemption for Indian IT and BPO firms:

(1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where—

— Digital Personal Data Protection Act, 2023, Section 17(1)

Clause (d) covers personal data of people “not within the territory of India” processed under a contract with a person outside India by a person based in India. Even then, S.8(1) (responsibility for processing done by you or on your behalf) and S.8(5) (reasonable security safeguards) still apply. Your own employees’ data is not foreign clients’ data.

What to do. Confirm all three conditions for each contract, keep your security safeguards to the Rule 6 standard, and treat your Indian staff and Indian-resident data as fully in scope.

Myth 10: “We’re outside India, so it can’t reach us”

What the Act says.

also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;

— Digital Personal Data Protection Act, 2023, Section 3(b)

For a foreign SaaS company selling to Indian users, the DPDP Act applies to that processing. For transfers out of India, see cross-border data transfer.

What to do. If you sell to people in India, plan as an Indian company would for that processing.

Who is in scope: common cases side by side

Situation	In scope?	Why
8-person agency with a client CRM	Yes	S.2(i), S.2(t): any person; contacts are personal data
Payroll for your own staff	Yes, without consent	S.7(i), with S.8(5) and S.8(6) still applying
Paper visitor register never typed up	No	S.3(a): the Act covers digital personal data
Paper forms typed into a spreadsheet	Yes	S.3(a)(ii): collected on paper, digitised later
An individual’s personal phone contacts	No	S.3(c)(i): personal or domestic purpose
A profile the person posted publicly	No	S.3(c)(ii)(A)
A lead list compiled by a third party	Yes, unless each person made it public	S.3(c)(ii) turns on who published it
Indian BPO handling US customers’ data under a US contract	Partly: S.8(1) and S.8(5) only	S.17(1)(d)
Foreign SaaS selling to users in India	Yes	S.3(b)
Recognised startup	Yes, unless a notification covers it	S.17(3)

What should a small company do about DPDP Act scope?

1. List every source of personal data: customers, leads, staff, applicants, vendors’ contacts, website forms. Include paper that ends up on a computer.
2. Mark each one Data Fiduciary or Data Processor. If you decide the purpose and means, it is yours (S.2(i)); if you act on a customer’s instructions, it is theirs and your contract governs (S.8(2)).
3. Record the ground for each flow: consent, employment under S.7(i), or another S.7 use.
4. Test each claimed exclusion against its exact wording: personal or domestic use, data the person made public, or foreign data under S.17(1)(d). Write down why it applies.
5. Check for notifications under S.17(3) and S.17(5) before relying on any exemption, and again before 13 May 2027.
6. Start the long jobs now: notices for existing customers (S.5(2)), one-year logging (Rule 6(1)(e)) and processor contracts (Rule 6(1)(f)).

Related obligations

• Breach intimation: applies to every Data Fiduciary in scope, whatever its size.
• The full checklist: all eleven obligations on one page, and what Significant Data Fiduciaries do on top.

Further reading on the blog:

• DPDPA compliance guide: consent and the legitimate uses in S.7.
• SOC 2 and DPDPA and the ISO 27001 mapping: what a certification does and doesn’t cover.
• DPDPA glossary: the Act’s defined terms.

Frequently asked questions

Does the DPDP Act apply to a 10-person company?

Yes. The DPDP Act applies to every Data Fiduciary, which is “any person” that decides the purpose and means of processing personal data (S.2(i)). There is no headcount or turnover threshold.

Is there a startup exemption under the DPDP Act?

Not by default. S.17(3) lets the Central Government notify classes of Data Fiduciaries, including recognised startups, to whom S.5, S.8(3), S.8(7), S.10 and S.11 don’t apply. Until a notification covers you, the whole Act applies. Safeguards and breach intimation would apply even then.

Does a B2B company need to comply?

Yes. The people at your customers, suppliers and leads are individuals, so their data is personal data (S.2(t)). Your own employees’ data is in scope too.

Do we need consent to process employee data?

Not for employment purposes: S.7(i) is a legitimate use. Security safeguards, breach intimation and grievance redressal still apply to that data.

Are paper files covered?

Only once they are digitised. The Act covers personal data collected in digital form, or collected on paper and “digitised subsequently” (S.3(a)).

Does ISO 27001 or SOC 2 certification mean we comply?

No. Neither the Act nor the Rules recognise a certification for a Data Fiduciary. Your controls may cover much of Rule 6; notice, consent, rights, grievances and erasure are separate duties.

When does the DPDP Act apply from?

Most duties apply from 13 May 2027, eighteen months after the Rules were published (Rule 1(4)). Consent Manager registration opens on 13 November 2026 (Rule 1(3)).

---

Checked against the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) on 25 October 2026. This page explains the law; it is not legal advice.

Not sure which duties apply to you? The free DPDP Gap Identifier walks through them. If you’d rather talk it through with an engineer, get in touch.