Scope and Applicability

The DPDPA applies to the processing of 'digital personal data' - personal data that is collected in digital form or collected in non-digital form and subsequently digitised. This covers virtually all modern data processing activities. The Act does not apply to: (a) personal data processed by an individual for personal or domestic purposes; and (b) personal data that has been made publicly available by the Data Principal or any other person under a legal obligation.

The Act applies to processing of digital personal data within India, regardless of whether the data controller is Indian or foreign. It also applies to processing outside India if such processing is in connection with offering goods or services to Data Principals in India. This extraterritorial reach ensures that foreign entities targeting Indian consumers are subject to the Act's requirements.

The Act applies to Data Fiduciaries (entities that determine purpose and means of processing), Data Processors (entities that process on behalf of Fiduciaries), and Consent Managers (registered entities that manage consent on behalf of Data Principals). Both private sector and government entities are covered, though government entities benefit from broader exemptions under Section 17.

Personal or domestic processing is excluded - an individual's personal contacts list or family photos are not covered. Publicly available data (made public by the Data Principal or under legal obligation) is also excluded. Anonymised data falls outside the scope since it no longer constitutes 'personal data'. However, the Act does not define anonymisation standards, leaving this to industry practice and potential future guidance.