DPDP Act Applicability: Which Companies Need to Comply in India?

The Digital Personal Data Protection Act, 2023 (DPDP Act) has created an important data protection framework for organisations handling digital personal data in India.

One of the first questions business owners ask is:

“Does the DPDP Act apply to my company?”

The answer does not depend only on whether you are a large enterprise. Startups, SMEs, e-commerce businesses, hospitals, educational institutions, financial companies, SaaS providers and many other organisations can potentially fall within the DPDP framework depending on how they process personal data.

The DPDP Act applies to processing of digital personal data in India where the data was collected digitally or collected offline and subsequently digitised. It can also apply to processing outside India when connected with offering goods or services to Data Principals in India.

What Kind of Data Is Covered?

The DPDP Act defines personal data broadly as data about an individual who is identifiable by or in relation to that data.

For businesses, this can include information such as customer names, mobile numbers, email addresses, addresses, account information, employee information and other information linked to identifiable individuals.

Therefore, if your organisation maintains digital records relating to customers, employees, users, patients, students, vendors or other individuals, the DPDP Act should be part of your compliance assessment.

Which Companies Should Assess DPDP Compliance?

There is no simple rule saying that only companies above a particular turnover or employee count need to consider the DPDP Act.

The Act's definition of a “person” includes companies, firms, individuals, associations and other entities, while its application provisions focus primarily on the processing of digital personal data.

This means organisations across many sectors should assess their obligations.

E-commerce and Retail Businesses

Online stores can process customer names, mobile numbers, addresses, transaction information, account details and marketing preferences.

They should evaluate their data collection, notices, consent where applicable, customer rights, security and retention practices.

SaaS and Technology Companies

SaaS providers frequently process user registration information, contact information, application usage data and customer-related personal data.

They should also carefully determine whether they operate as a Data Fiduciary, Data Processor, or in different roles depending on the processing activity.

Hospitals and Healthcare Organisations

Hospitals, clinics, diagnostic centres and health-tech businesses maintain large volumes of digital patient information.

They should assess how patient information is collected, accessed, shared, secured and retained, while also determining the appropriate basis for each processing activity.

Banks, NBFCs, FinTech and Financial Services

Financial organisations process extensive customer information for onboarding, transactions, communications, fraud prevention and service delivery.

DPDP compliance should therefore form part of their broader privacy and data-governance strategy.

Schools, Colleges and EdTech Companies

Educational organisations can process information relating to students, parents, teachers and employees.

Children's personal data deserves particular attention because the DPDP framework contains specific requirements relating to children.

HR and Recruitment Companies

Recruitment platforms, staffing agencies and employers may process resumes, contact details, employment histories, payroll information, attendance and other employee-related personal data.

Not every employment-related processing activity necessarily relies on consent, so organisations should determine the appropriate basis for processing rather than adding consent checkboxes indiscriminately.

Marketing and Digital Agencies

Agencies may process customer databases, leads, campaign information and marketing preferences for themselves or their clients.

They should understand both their role in the processing and the responsibilities arising from it.

Does the DPDP Act Apply to Startups and SMEs?

Potentially, yes.

Being a small business does not by itself mean that an organisation can ignore the DPDP Act.

A startup collecting customer information through an application or an SME maintaining customer and employee information digitally should assess whether its processing falls within the Act and what obligations apply.

At the same time, businesses should avoid assuming that every organisation has identical obligations. The precise requirements can depend on the organisation's role, processing activity, applicable exemptions and whether it is designated as a Significant Data Fiduciary.

Can the DPDP Act Apply to Foreign Companies?

Yes.

The DPDP Act expressly provides for extra-territorial application where digital personal data is processed outside India in connection with an activity related to offering goods or services to Data Principals within India.

This means an overseas company cannot automatically assume that the DPDP Act is irrelevant simply because its servers or headquarters are outside India.

Are There Any Exclusions or Exemptions?

Yes. Applicability should not be interpreted as meaning that every instance of personal-data processing is treated identically.

For example, the Act excludes personal data processed by an individual for personal or domestic purposes and personal data made publicly available by the Data Principal or under a legal obligation to make it publicly available. The Act also contains exemptions for specified processing circumstances.

Businesses should therefore perform an applicability assessment rather than relying on a generic statement that “DPDP applies to everyone.”

DPDP Compliance Is Being Implemented in Phases

Another important consideration is timing.

The Government notified the Digital Personal Data Protection Rules, 2025 in November 2025 and established a phased commencement framework. Some provisions took effect upon publication, some are scheduled one year later, and major substantive provisions of the Act and Rules are scheduled eighteen months after the November 2025 notification.

For businesses, this phased timeline provides an implementation window—but organisations with significant personal-data operations should use that time to prepare their systems and processes rather than waiting until the final stage.

How Can a Business Check Whether It Needs DPDP Compliance?

Start with a few practical questions:

• Does your company collect or process digital personal data?
• Do you collect customer, employee, patient, student or user information?
• Do you operate a website or mobile application that collects identifiable user information?
• Do you share personal data with third-party vendors or Data Processors?
• Do you use personal data for marketing or customer communication?
• Do you process children's personal data?
• Do you offer goods or services to individuals in India?
• Can users request changes, erasure or withdrawal of consent where applicable?

If several answers are yes, your organisation should conduct a proper DPDP applicability and compliance assessment.

Where Consent Server Fits In

Once an organisation determines that it needs to build DPDP compliance processes, technology becomes important—particularly where consent is relied upon or where Data Principal workflows need to be managed at scale.

Consent Server is a centralized Consent Management Platform designed to help Indian businesses manage consent and related DPDP workflows.

It can support purpose-based consent, consent updates and withdrawals, Data Principal requests, grievance workflows, audit-ready records, lifecycle automation, role-based access, reporting, APIs and webhooks.

Consent Server can also integrate with existing websites, CRM platforms, HR systems, databases and other business applications, allowing organisations to create a centralized DPDP Consent Management Platform rather than maintaining disconnected consent records.

For organisations searching for a DPDP Platform, DPDP Management System, DPDP Software, or Consent Management Platform, Consent Server provides a comprehensive solution to evaluate.

Final Thoughts

The question businesses should ask is not simply:

“Is my company big enough for the DPDP Act?”

A better question is:

“What digital personal data do we process, why do we process it, and what DPDP obligations apply to those activities?”

Whether you operate a startup, SME, hospital, school, e-commerce business, SaaS platform, financial organisation or large enterprise, understanding DPDP Act applicability is the first step toward building an effective compliance program.