Who the DPDP Act applies to: Fiduciaries, Processors, exemptions

The DPDP Act applies to the processing of digital personal data in India, including paper records that are later digitised, and to processing outside India connected with offering goods or services to people in India s.3(a) and (b). Whoever decides why and how that data is processed is a Data Fiduciary and carries the duties, whatever its size s.2(i), s.8(1); a vendor that processes the data on its behalf is a Data Processor s.2(k). The Act does not apply to personal or domestic use, or to data made public by the person or under a legal duty (s.3(c)), and s.17 sets out narrower exemptions.

What data does the Act cover?

Personal data is "any data about an individual who is identifiable by or in relation to such data" (s.2(t)), and digital personal data is personal data in digital form s.2(n). The Act covers that data where it is collected in digital form, or collected on paper and digitised later s.3(a). A paper register that is never typed, scanned or photographed into a system falls outside s.3(a).

Processing is broad: any wholly or partly automated operation on digital personal data, including collection, recording, storage, use, sharing, disclosure and erasure s.2(x). A customer's phone number kept in a billing app, a patient file in clinic software, an employee record in a payroll spreadsheet and a chat on WhatsApp Business are all processing of digital personal data.

Does it apply to processing outside India?

Yes, where the processing is "in connection with any activity related to offering of goods or services to Data Principals within the territory of India" s.3(b). A business abroad that sells to people in India is covered for that processing.

The reverse case is largely exempt. Where a person based in India processes personal data of people outside India under a contract with a person outside India, Chapter II (except s.8(1) and (5)), Chapter III and s.16 do not apply s.17(1)(d). An Indian firm serving a foreign client's customers keeps the duty to be responsible for its processing and to protect the data with reasonable security safeguards.

Who is a Data Fiduciary?

"Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data" s.2(i). A person includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and every artificial juristic person s.2(s).

The Act sets no turnover, headcount or customer count threshold for being a Data Fiduciary. Thresholds appear only for particular extra duties, set out below. A pharmacy, a clinic, a school, an accounting firm and a listed bank are all Data Fiduciaries for the personal data whose purpose and means they decide. The pages on DPDP for clinics and hospitals and DPDP for D2C and ecommerce show the duties that weigh most for those businesses, and DPDP software for partner firms covers an accounting or advisory firm that looks after several of them.

The Data Fiduciary is responsible for complying with the Act and the Rules "irrespective of any agreement to the contrary", including for processing done for it by a Data Processor s.8(1).

Who is a Data Processor, and what does it owe?

"Any person who processes personal data on behalf of a Data Fiduciary" (s.2(k)): a cloud host, a payroll provider, a messaging service, a courier, an accounting firm handling a client's staff records.

The duties in Chapter II are addressed to the Data Fiduciary, and they reach the processor through the Data Fiduciary:

• a processor may be engaged only under a valid contract (s.8(2)), which must provide for reasonable security safeguards Rule 6(1)(f);
• the Data Fiduciary must cause its processors to stop processing when consent is withdrawn (s.6(6)) and to erase data when the purpose ends s.8(7)(b);
• in the illustration to Rule 8(3) (Case 2), the Data Fiduciary must ensure that the cloud provider it engages as a processor keeps the data and its logs for at least one year before erasure.

The same company can hold both roles. Fohrkast is a useful example: it processes records for each business under a processor agreement (fohrkast.com/dpa, s.8(2)), and it is the Data Fiduciary for its own users and visitors (fohrkast.com/privacy).

The DPDP for SaaS and payroll providers page sets out what a provider owes in each role.

What is outside the Act altogether?

• Personal data processed by an individual for a personal or domestic purpose s.3(c)(i).
• Personal data made publicly available by the individual it relates to, or by a person under a legal obligation to publish it s.3(c)(ii).
• Processing by a State instrumentality the Central Government notifies on grounds such as sovereignty, security of the State or public order s.17(2)(a).
• Processing necessary for research, archiving or statistical purposes, where the data is not used for a decision specific to a person and the standards in the Second Schedule are followed s.17(2)(b), Rule 16.

Which duties are lifted in particular cases?

Section 17(1) switches off most of Chapter II (except s.8(1) and (5)), all of Chapter III and s.16 where processing is necessary for:

• enforcing a legal right or claim (a);
• a court, tribunal or regulator performing its judicial, quasi judicial, regulatory or supervisory function (b);
• preventing, detecting, investigating or prosecuting an offence (c);
• the offshore contracts described above (d);
• a merger, demerger or similar scheme approved by a court, tribunal or competent authority (e);
• finding the financial information, assets and liabilities of a borrower who has defaulted on a loan from a financial institution (f).

Three further routes:

• Notified classes, including startups. The Central Government may notify Data Fiduciaries or classes of them, including startups, to whom s.5 (notice), s.8(3) and (7) (accuracy and erasure), s.10 (Significant Data Fiduciaries) and s.11 (access) do not apply s.17(3). A startup here is a private company, partnership firm or LLP recognised under the government's startup criteria. Fohrkast's rulebook (in.dpdp version 1) records no such notification as of 21 October 2026.
• The State. For processing by the State or its instrumentalities, s.8(7), s.12(3) and, where no decision affecting the person is made, s.12(2) do not apply s.17(4).
• Time bound declarations. Within five years of the Act's commencement, the Central Government may declare by notification that any provision does not apply to particular Data Fiduciaries or classes for a stated period s.17(5).

Rule 12 and the Fourth Schedule also relax the children's duties in s.9(1) and (3) for listed classes, such as clinical establishments and healthcare professionals, and for listed purposes, each subject to conditions.

Who carries extra duties?

• Significant Data Fiduciaries, once notified by the Central Government under s.10(1): a Data Protection Officer based in India, an independent data auditor, and a Data Protection Impact Assessment and audit every 12 months s.10(2), Rule 13. Fohrkast's rulebook records no notification as of 21 October 2026.
• Large platforms in the Third Schedule: ecommerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore must erase the data of users inactive for three years, after 48 hours' notice s.8(8), Rule 8(1) and (2).
• Anyone processing children's data (under 18, s.2(f)) needs verifiable parental consent and must not track, behaviourally monitor or target advertising at children s.9, Rule 10.

When do these provisions start?

Sections 3 and 17, with nearly every other duty, start on 13 May 2027 G.S.R. 843(E), item (c). The DPDP dates post sets out the start dates and the question of 13 or 14 May.

How does Fohrkast work this out for a business?

At setup, Fohrkast asks plain questions: does the business keep details about people on a phone, computer, app or website; does another company handle those details for it; do children use its service; has the government named it a Significant Data Fiduciary. Each answer switches the matching duties in rulebook in.dpdp version 1 on or off, and the register shows the clause behind each one. The DPDP compliance checklist lists every duty in rulebook in.dpdp version 1 with its clause and start date.

Fohrkast dates each of these duties for the business and keeps the evidence. Request access »