DPDP Act Applicability: India's Data Law for Your Business

DPDP Act Applicability: Does India's Data Law Cover Your Business?

Understanding if the Digital Personal Data Protection (DPDP) Act, 2023, applies to your business is the critical first step towards compliance. Many Indian businesses, from startups to large enterprises, are asking this question. The quick answer depends on how your business handles personal data of individuals in India.

What the DPDP Act Says About Scope

The DPDP Act clearly defines its territorial and material scope. It covers the processing of digital personal data inside India. Crucially, it also extends to processing personal data outside India if that processing relates to offering goods or services to Data Principals (individuals) within India, or for profiling such Data Principals.

This means even if your servers are overseas, but you serve an Indian customer base, the DPDP Act likely applies to you. Sushant Pasumarty, founder of Meridian Bridge Strategy (MBS), emphasizes, "Many businesses mistakenly believe that an overseas presence exempts them. The Act's reach is broad, focusing on the location of the Data Principal."

The Applicability Test: 3 Key Questions

To determine if the DPDP Act applies to your business, ask these three questions:

1. Do you process 'personal data'? This includes any data about an individual who is identifiable by or in relation to such data. Examples include names, phone numbers, email addresses, IP addresses, or even transaction histories linked to a person.
2. Is the processing within India? This covers any operation or set of operations performed on personal data, whether automated or manual, within the territory of India.
3. If processing is outside India, are you offering goods or services to Data Principals in India, or profiling them? This extends the Act's reach to businesses targeting the Indian market, regardless of their physical location.

Practical Implications for Your Business

If the DPDP Act applies to your business, you become a 'Data Fiduciary.' This designation comes with significant responsibilities, including obligations for consent, data security, data breach notification, and maintaining the accuracy of data. Failing the applicability test can lead to significant penalties.

For instance, a tech startup collecting user analytics from Indian users, or an e-commerce platform selling to Indian customers, falls under the Act. Even a small HR department processing employee data is covered. MBS has guided over 20 companies through initial applicability assessments.

Cost to Comply: MBS Services & Price Ranges

Understanding your applicability is just the start. Complying with the DPDP Act involves structured steps. Meridian Bridge Strategy (MBS) offers productized services tailored to different levels of need and budget. Here's an overview of the typical investment:

"The cost of compliance is an investment in trust and avoiding penalties," says Sushant Pasumarty. "Our tiered services help businesses right-size their DPDP journey."

Common Mistakes Businesses Make

• Ignoring small data sets: Believing the Act only applies to large data holders. Any personal data processing is covered.
• Assuming overseas exemption: Not recognizing the Act's extraterritorial reach for services targeting India.
• Delaying assessment: Waiting for penalties or data breaches to prompt action. Early assessment saves cost and reputation.
• Confusing DPDP with GDPR: While similar, the DPDP Act has specific nuances and requirements unique to the Indian context.

Your Next Step: Verify Your Applicability

Determining your exact status under the DPDP Act is crucial. If you process any personal data of individuals in India, it's highly probable the Act applies to you. For a deeper dive into compliance, consider exploring our resources on DPDP compliance roadmaps.