When does the Act apply to you?

A practical applicability checklist for any organisation that touches personal data of people in India.

Free preview 8 min read Verified

Legal basis

DPDP Act 2023 (No. 22 of 2023) + DPDP Rules 2025 (G.S.R. 843(E)-846(E), notified 13 November 2025)

This is the lesson that answers: am I bound by the DPDP Act? Most organisations operating in or selling into India are. A few are not. This lesson tells you which group you are in. The general rule Section 3 of the Act sets out applicability. The Act applies to: Processing of digital personal data within the territory of India, where the data is collected in digital form, or in non-digital form and digitised subsequently [L4-C1]. Processing of digital personal data outside the territory of India, if the processing is…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

DPDP Act 2023, Section 3 (Application of the Act) L4-C2

The Act applies to processing of digital personal data within India collected in digital form or digitised subsequently; and to processing outside India if in connection with offering goods or services to Data Principals in India. It does not apply to personal or domestic use, or to data made publicly available by the Data Principal or under law.

DPDP Act 2023, Section 16 (Processing of personal data outside India) L4-C3

The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary to countries or territories outside India. Nothing in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection or restriction on transfer.

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: DPDPA 101: Why this law, why now

Module 2: The Five Players

The Data Principal
The Data Fiduciary
The Data Processor
Significant Data Fiduciary and Consent Manager

Module 3: Data Principal Rights

Right to access information about personal data (Section 11)
Right to correction and erasure (Section 12)
Right of grievance redressal (Section 13)
Right to nominate (Section 14)
Duties of Data Principal (Section 15)

Module 4: Data Fiduciary Obligations

Lawful grounds for processing (Section 4)
Notice (Section 5 and Rule 3)
Certain legitimate uses (Section 7)
General obligations: security, breach, erasure, DPO contact (Section 8)
Children's data (Section 9 and Rule 10)

Module 5: Implementation Toolkit

Data mapping
Record of Processing Activities (RoPA)
Consent architecture
Breach response runbook
Retention design

Module 6: SDF, DPIA and DPO

Becoming a Significant Data Fiduciary
The Data Protection Officer
Data Protection Impact Assessment
Independent audit and algorithmic diligence

Module 7: Enforcement and Penalties

The Data Protection Board of India
The Schedule penalty matrix
Handling a Board inquiry
Voluntary undertakings, ADR, and the appeals path

Module 8: AI, sectoral overlays and DPDPA

The AI lifecycle under DPDPA
Data minimisation for AI systems
Notice and consent design for AI
Fairness, bias, and explainability
EU AI Act risk tiers mapped to DPDPA
Machine unlearning and the right to erasure
RBI Data Governance Framework for BFSI (July 2026 draft)