Question · Scope
Does the DPDP Act apply to my business?
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Almost certainly yes. The Act applies to any processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. There is no size, turnover or sector threshold. The only questions are which obligations apply and when they start.
The test in Section 3
Section 3 applies the Act to digital personal data processed in India, including data collected on paper and digitised afterwards, and to processing outside India in connection with offering goods or services to Data Principals in India. It does not apply to personal data processed by an individual for personal or domestic purposes, or to data made publicly available by the Data Principal or under a legal obligation.
What "processing" catches
Section 2 lists collection, storage, use, sharing, disclosure and erasure among others. A contact form, an analytics tag, an email list, a CRM, a payroll file and a WhatsApp group with customers are all processing. If your business has a website or a customer, it processes personal data.
The exemptions, and how narrow they are
Section 17 exempts specific processing: enforcing legal rights and claims, courts and regulators, prevention and investigation of offences, certain offshore contracts, mergers approved by a tribunal, and debt recovery. It also lets the Government notify startups and other classes as exempt from a few provisions under Section 17(3). None of these switch off the Act for a business as a whole.
When it starts
The Board and the Consent Manager framework are already live or arrive in November 2026. The bulk of the obligations a business is judged against, notice, consent standard, security, breach, rights, arrive on 13 May 2027 under Rule 1. Every page in this reference shows the commencement date for the provision it cites.
Questions people ask
- We are a small business with a few hundred customers. Does it apply?
- Yes. There is no threshold. The Government may notify certain classes as exempt from some provisions under Section 17(3), but nothing is exempt by default.
- We are a foreign company selling to Indians online. Does it apply?
- Yes. Section 3(b) covers processing outside India in connection with offering goods or services to Data Principals in India.
- We only process business contacts, not consumers. Does it apply?
- Yes. A person’s work email and phone number are personal data; the Act does not carve out professional data.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.