The DPDP Act applies to any business, of any size, that processes digital personal data of individuals, including B2B firms, employers and startups. It also applies to foreign businesses offering goods or services to people in India. It does not apply to purely personal or household use, to data the individual made public themselves, or to company (non-personal) data.
- Size threshold
- None
- Covers B2B contacts
- Yes
- Covers employee data
- Yes
- Applies to foreign firms
- If offering goods or services in India
A quick test
If you answer yes to any of these, the DPDP Act applies to you:
- Do you collect names, phone numbers, emails, addresses, IDs or photos through a website, app, form, WhatsApp or spreadsheet?
- Do you keep employee, candidate or contractor records digitally?
- Do you hold contact details of people at client or vendor companies in a CRM or email list?
- Do you run CCTV that stores footage digitally?
What is outside the Act
| Excluded | Example |
|---|---|
| Personal or domestic use by an individual | Your personal phone contacts |
| Data the individual made public themselves | A person's own public post; but check how and why it was published |
| Data made public under a legal obligation | Director names on the MCA portal |
| Non-personal data | Company name, GSTIN, turnover, anonymised statistics |
| Paper records never digitised | A physical visitor register that is never scanned |
Startups and small businesses
There is no exemption by size. Section 17(3) lets the central government exempt notified classes of Data Fiduciaries, including startups, from some duties (the notice duty, the accuracy and erasure duties in Section 8(3) and 8(7), Significant Data Fiduciary duties and the right to access information). Until such a notification covers you, plan to comply in full. The duties scale in practice: a 10-person firm needs a clear notice, an opt-in, a vendor list and a breach plan, not an enterprise privacy programme.
Foreign companies
Section 3(b) extends the Act to processing outside India if it is connected to offering goods or services to Data Principals in India. A foreign SaaS or e-commerce business selling to Indian users is covered.
Frequently asked questions
Is B2B data covered by the DPDP Act?
Yes, where it identifies a person. A contact's name, work email and mobile number are personal data. Company-level data such as a company's name, GSTIN or turnover is not.
Does the DPDP Act apply to sole proprietors and freelancers?
Yes, when they process clients' or others' personal data for business. Only personal or domestic use is excluded.
Does the DPDP Act apply to NGOs and trusts?
Yes. The Act applies to any 'person' processing digital personal data, which includes trusts, societies and NGOs.
Is publicly available data free to use under the DPDP Act?
Only data that the individual made public themselves, or that was published under a legal duty, is outside the Act. Scraping data others published about a person is not automatically excluded, and other laws may still apply.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.