On this page
- What is the DPDP Act and who does it apply to?
- Does the DPDP Act apply to small businesses?
- Key DPDP Act terms: Data Principal, Data Fiduciary, Data Processor and more
- What does the DPDP Act not apply to? Exceptions and exemptions
- How does the DPDP Act treat employee data and children’s data?
- Does the DPDP Act apply to a gym, clinic, school or shop? Worked examples
- When does the DPDP Act apply, and what are the penalties?
- How DVM Techno Can Help
- FAQs
Key takeaways
- Section 3 of the DPDP Act covers digital personal data processed in India, paper data that is later digitised, and processing abroad linked to offering goods or services to people in India.
- The Act has no turnover or size threshold; a one-room clinic, a gym and a large company are all Data Fiduciaries when they decide why and how personal data is used.
- Section 3(c) keeps personal or domestic use and data made public out of scope, while Section 17 switches off most duties for listed purposes but keeps the security duty.
- Employee data can be processed for employment purposes under Section 7(i); children’s data needs verifiable parental consent under Section 9, with narrow exemptions in the Rules.
What is the DPDP Act and who does it apply to?
The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, collected online or on paper and later digitised, and to processing abroad for offering goods or services to people in India. It does not apply to personal or domestic use by individuals, or to data made public by the person or under a legal duty.
DPDP stands for Digital Personal Data Protection. The DPDP Act (Act No. 22 of 2023) governs how organisations handle personal data about individuals. Section 3 sets its reach:
- Section 3(a), inside India: data collected in digital form, or collected on paper and digitised later. A paper admission form typed into school software is covered.
- Section 3(b), outside India: processing abroad connected with offering goods or services to people in India, such as a foreign online store selling to customers in Gurgaon.
- Section 3(c), not covered: data processed by an individual for a personal or domestic purpose, and data made public by the person it relates to, or by someone legally obliged to publish it.
Personal data is any data about an identifiable individual (Section 2(t)): names, phone numbers, photos, fee records, fingerprint templates. Processing (Section 2(x)) covers collection, storage, use, sharing and erasure, done wholly or partly by automated means.
Does the DPDP Act apply to small businesses?
Yes. The Act has no turnover, staff or customer threshold, so a single clinic on Sohna Road and a large company in Cyber City are both Data Fiduciaries once they decide why and how personal data is processed.
Section 2(s) defines “person” to include an individual, a Hindu undivided family, a company, a firm, an association of persons and the State. Size or type matters in only two places:
- Significant Data Fiduciaries (Section 10): the Government can notify a Data Fiduciary or class as significant, based on factors such as the volume and sensitivity of data. Only these must appoint a Data Protection Officer based in India and an independent data auditor, and run periodic impact assessments.
- Notified exemptions (Section 17(3)): having regard to the volume and nature of data, the Government can notify certain Data Fiduciaries, including startups, to whom Section 5 (notice), Sections 8(3) and 8(7), Section 10 and Section 11 do not apply.
Section 17(3) works only after a notification names your class of business. Until then, plan as if every duty applies, and check meity.gov.in before relying on an exemption.
Key DPDP Act terms: Data Principal, Data Fiduciary, Data Processor and more
Six roles defined in the Act decide who must do what: the person the data is about, the business that decides, the vendor working for it, and three bodies around them.
| Term (Section) | Meaning in plain words | Example |
|---|---|---|
| Data Principal (2(j)) | The individual the data is about; for a child, includes the parents or lawful guardian | A member, patient, student, customer or employee |
| Data Fiduciary (2(i)) | Any person who, alone or with others, decides the purpose and means of processing | The gym, clinic, school or shop |
| Significant Data Fiduciary (2(z), 10) | A Data Fiduciary or class the Government notifies, with extra duties | Only those notified |
| Data Processor (2(k)) | Any person who processes personal data on behalf of a Data Fiduciary | A hosting company or cloud software vendor |
| Consent Manager (2(g)) | A person registered with the Board who lets people give, manage, review and withdraw consent through one platform | A registered consent platform |
| Data Protection Board of India (2(c), 18) | The Board set up under Section 18; it inquires into breaches and imposes penalties (Sections 27 and 33) | Where complaints go |
Under Section 8(1), the Data Fiduciary stays responsible even for processing a Data Processor does for it, and Section 8(2) requires a valid contract with the processor.
What does the DPDP Act not apply to? Exceptions and exemptions
Section 3(c) puts some data fully outside the Act, and Section 17 switches off most duties for listed purposes while keeping the duty to protect data.
A family’s phone contacts are domestic use; the Act’s own illustration is a person who has made her data public on social media while blogging. A shopkeeper’s customer list on the same phone is business use.
Section 17(1) says Chapter II (except Sections 8(1) and 8(5)), Chapter III and Section 16 do not apply where processing is:
- necessary for enforcing a legal right or claim;
- by a court, tribunal or regulator, where necessary for its function;
- in the interest of preventing, detecting, investigating or prosecuting an offence;
- of people outside India, by a person in India under a contract with a person outside India;
- necessary for an approved merger, demerger or similar scheme;
- to find the assets and liabilities of a loan defaulter, subject to other disclosure laws.
Section 17(2) takes notified State instrumentalities (on grounds such as security and public order) and research, archiving or statistical processing that meets prescribed standards out of the Act altogether. Section 17(5) lets the Government, within five years of commencement, exempt certain Data Fiduciaries from any provision for a set period by notification.
How does the DPDP Act treat employee data and children’s data?
Employee data is covered, but Section 7(i) lets an employer process it for employment purposes without consent. Children’s data needs verifiable parental consent under Section 9.
Section 4 allows processing with consent or for “certain legitimate uses” in Section 7. Clause (i) covers “the purposes of employment or those related to safeguarding the employer from loss or liability”, such as protecting trade secrets or providing a benefit an employee asks for. Payroll and attendance fit; a trainer’s photo in an advertisement does not, so ask first. Security and breach duties under Sections 8(5) and 8(6) still apply.
A child is anyone under eighteen (Section 2(f)). A Data Fiduciary must get verifiable consent from a parent or lawful guardian before processing a child’s data (9(1)), must avoid harm to the child’s well-being (9(2)), and must not track, behaviourally monitor or target ads at children (9(3)).
The Fourth Schedule of the DPDP Rules, 2025 (Rule 12) lifts Sections 9(1) and 9(3) only in narrow cases, for example clinical establishments providing health services to the child, schools tracking for educational activities or safety, and school transport tracking location during travel. Otherwise, plan for parental consent.
Does the DPDP Act apply to a gym, clinic, school or shop? Worked examples
For each business below the answer is yes, because it decides why personal data is collected and holds it digitally. The reasoning is ours, from Sections 2, 3, 7, 9 and 17; it is not legal advice.
| Situation | Does it apply? Why |
|---|---|
| Gym with member software and fingerprint check-in | Yes. The gym is the Data Fiduciary for names, photos, fingerprint templates and fees. Members under eighteen need parental consent. |
| Clinic with an online appointment form | Yes. Form entries are digital personal data; the form host is a Data Processor, but the clinic stays responsible. |
| School with an enquiry page and ERP | Yes. Students are children, so Section 9 applies, subject to the narrow Fourth Schedule exemptions. |
| Shop in Udyog Vihar with CCTV | Yes, where people can be identified: recorded footage is digital personal data. Giving police a clip for a theft inquiry falls within Section 17(1)(c). |
| WhatsApp customer list | Yes. A number given for an order can be used for that order (Section 7(a)) unless the customer objects; offers are a separate purpose needing consent. |
| Your personal phone contacts | No. Personal or domestic use under Section 3(c)(i). |
- Gyms: see our gym biometric attendance and DPDP Act guide.
- Clinics and schools: the DPDP checklist for clinic and school websites covers form notices.
- Shops: if you send offers through a WhatsApp CRM, record when each customer agreed.
When does the DPDP Act apply, and what are the penalties?
The DPDP Rules, 2025 were notified on 13 November 2025; Section 3 itself, most duties and the penalty sections come into force eighteen months after that.
The commencement order G.S.R. 843(E) sets this, and the PIB release of 14 November 2025 calls it an 18-month phased timeline. For every date, see our DPDP Act implementation timeline.
The Schedule sets maximum penalties, decided by the Board after an inquiry: up to two hundred and fifty crore rupees for failing to take reasonable security safeguards; up to two hundred crore rupees for failing to report a breach or breaking children’s data duties; up to one hundred and fifty crore rupees for a Significant Data Fiduciary’s extra duties; up to fifty crore rupees for other breaches; and up to ten thousand rupees for a Data Principal breaking her duties.
How DVM Techno Can Help
DVM Techno is a web and software company with its team in Gurgaon. We can add a privacy notice page, form notices, unticked consent boxes and a grievance contact to your website. See our website development services in Gurgaon or call +91-8448523313. A lawyer should review the legal wording.
This is general information, not legal advice. Notifications can change exemptions and dates, so check the latest MeitY notification and ask a lawyer how the DPDP Act applies to your business.
Frequently Asked Questions
What is the full form of DPDP Act?
DPDP stands for Digital Personal Data Protection. The full name of the law is the Digital Personal Data Protection Act, 2023, Act No. 22 of 2023. It sets out how organisations, called Data Fiduciaries, may collect and use digital personal data, and the rights and duties of individuals, called Data Principals. The Act and the DPDP Rules, 2025 are published on meity.gov.in.
Who does the DPDP Act apply to?
Under Section 3, it applies to processing of digital personal data within India, including data collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India. Any person can be a Data Fiduciary, including an individual, a firm, a company or the State. There is no turnover or size threshold in the Act.
What does the DPDP Act not apply to?
Section 3(c) excludes personal data processed by an individual for personal or domestic purposes, and personal data made publicly available by the person it relates to or by someone legally required to publish it. Section 17(2) also excludes processing by State instrumentalities notified by the Government on security and similar grounds, and research, archiving or statistical processing that meets prescribed standards.
What are the exemptions under Section 17 of the DPDP Act?
Section 17(1) switches off most duties, but not the security duty, where processing is needed to enforce legal rights or claims, by courts and regulators, to prevent or investigate offences, for foreign data under contract, for approved mergers, or to trace a loan defaulter’s assets. Section 17(3) lets the Government notify some Data Fiduciaries, including startups, as exempt from certain sections.
Does the DPDP Act apply to employee data?
Yes. Staff data is personal data, but Section 7(i) lists employment purposes, and safeguarding the employer from loss or liability, as certain legitimate uses. An employer can process staff data for those purposes without separate consent. Security safeguards and breach reporting under Section 8 still apply, and using staff data for an unrelated purpose, such as marketing, should be done with consent.
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides the purpose and means of processing personal data, such as a clinic deciding to collect appointment details. A Data Processor processes data on the fiduciary’s behalf, such as a hosting or software company. Under Section 8(1), the Data Fiduciary stays responsible for compliance, and Section 8(2) requires a valid contract before engaging a processor.
Does the DPDP Act apply to CCTV footage?
Where people in the footage can be identified, recorded CCTV video is personal data in digital form, so a shop, office or clinic recording it is a Data Fiduciary. The Act has no separate CCTV section. Sharing footage to help investigate an offence falls within the purposes in Section 17(1)(c). Ask a lawyer how notice and consent apply to your cameras.
Related articles
Get your website ready for the DPDP Act
We can add privacy notices, consent checkboxes and grievance contact details to your business website.