Lesson 1.3: Who and what the law covers

Module 1 · Lesson 1.3 of 8 · About 25 minutes · Who and what the law covers

The first question for any organisation is simple: does this law apply to us? This lesson gives you a clear test. This DPDPA 2023 course page explains who and what the law covers in plain language.

who and what the law covers - DPDPA 2023 course lesson banner

What you will learn about who and what the law covers

Apply the three-part scope test
Understand the extra-territorial reach
Know what is excluded from the Act

The three-part test (who and what the law covers)

The Act applies when (1) there is personal data, (2) it is in digital form or was digitised, and (3) the processing happens in India, or happens outside India in connection with offering goods or services to people in India.

Key terms

Term	Meaning in simple words
Personal data	Any data about an individual who can be identified by or in relation to that data
Digital personal data	Personal data collected in digital form, or collected offline and then digitised
Processing	Any operation on data, including collecting, storing, using, sharing, erasing
Data Principal	The individual the data is about
Data Fiduciary	Whoever decides why and how the data is processed

Try it: does the Act apply (who and what the law covers)

Select a scenario to see the answer.

Tap or click a step to see exactly what to do.

What is excluded

Personal data processed by an individual for personal or domestic purposes
Personal data that the Data Principal herself has made public, or that someone else made public under a legal obligation
Non-digital data that is never digitised

Common mistakes (who and what the law covers)

Assuming a small business is exempt. Size does not matter for the core duties, though the Rules allow the Government to exempt certain classes such as start-ups from some provisions.
Thinking only customer data counts. Employee, vendor and visitor data count too.
Ignoring offline data that later goes into a spreadsheet.

Activity (5 minutes)

List five types of people whose data your organisation holds (customers, staff, applicants, vendors, visitors). Mark each as digital or not.

Key takeaway: If you handle digital personal data of people in India, assume the Act applies to you.

Check your understanding of who and what the law covers

Q1. A clinic keeps a paper register that is never digitised. Is it covered?

Q2. A foreign website offers goods to people in India. Does the Act apply?

Q3. Does the Act cover data an individual keeps for purely personal use?

← Anatomy of the Act and the Rules The players in the data ecosystem →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for who and what the law covers: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.