Module 1 of 9Sections 1 to 47 min including the detail
What the Act actually does
Most compliance work goes wrong before it starts, because nobody agreed which data, which company and which activity the Act is talking about. This module fixes that.
- Data Principal
- The individual the personal data is about.
- Data Fiduciary
- Whoever determines the purpose and means of processing.
- Data Processor
- Whoever processes on a Fiduciary's behalf, under contract.
It covers digital personal data, and only that
Digital personal data, plus paper the moment it is scanned. And there is no sensitive category in this Act at all.
Outside the Act
- A visitor book that is never digitised
- Data you process for purely personal reasons
- Data the person themselves made public
Inside the Act
- Anything digital about an identifiable person
- Paper records once they are scanned
- A phone number, treated the same as a medical record
The detail, if you want it
The Act applies to personal data in digital form, and to personal data collected on paper that is later digitised. Paper that stays paper is outside it. This sounds like a technicality and is not: a consent form in a filing cabinet becomes in scope the moment somebody scans it.
Personal data means any data about an identifiable person. There is no separate category of sensitive personal data in this Act, which is a real departure from the rule India had before it and from the GDPR. Health data, financial data and a phone number are all simply personal data. Where the Act treats something as riskier, it does so through the obligations it attaches, not by labelling the data.
It reaches companies outside India
No Indian entity, no Indian staff, no Indian servers. If you offer goods or services to people in India, you are inside it.
The detail, if you want it
Processing inside India is covered. Processing outside India is also covered where it is in connection with offering goods or services to people in India. A company with no Indian entity, no Indian servers and Indian customers is inside the Act.
Two things are outside it. Personal data a person processes for a purely personal or domestic reason. And personal data that the person themselves made publicly available, or that someone was required by law to make public. That second exemption is narrower than it sounds: data that a third party scraped and published does not become exempt because it is now public.
Four roles, and you are probably more than one
Most organisations are a Fiduciary for their own customers and a Processor for their clients, at the same time, for different data.
Who is who
- Data Principalthe person the data is about
- Data Fiduciarydecides why and how it is processed, and carries the duty
- Data Processorprocesses on a Fiduciary's behalf, under contract
- Consent Managera registered intermediary, accountable to the person
The detail, if you want it
The Data Principal is the person the data is about. The Data Fiduciary decides why and how the data is processed. The Data Processor processes it on a Fiduciary's behalf. A Consent Manager is a registered intermediary through which a person can give, manage and withdraw consent.
The word fiduciary is doing real work. It signals a duty of care rather than a licence obtained by ticking a box. Most organisations are a Fiduciary for their own customers and staff, and a Processor for their clients, at the same time, for different data. Getting that mapping wrong is the most common cause of a compliance programme that protects the wrong things.
The three things to remember
- Digital personal data, plus paper once it is digitised. Paper that stays paper is outside the Act.
- There is no sensitive category in this Act. A phone number carries the same core duties as a medical record.
- Processing outside India is covered where it serves people in India. No Indian entity is required.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A written list of the personal data your organisation holds, by system, with a named owner for each.
- For each of those, whether you are the Data Fiduciary or a Data Processor, and on whose behalf.
- A decision, recorded, on whether any offshore processing is caught by the extraterritorial reach.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.