# Lesson 1: What the DPDP Act covers | Learn DPDP | FOCTTA > What the Digital Personal Data Protection Act does, which data and organisations it covers, and what it leaves out. Web page: https://foctta.com/learn/what-the-act-covers This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 1 Lesson 1 of 12 · 5 min read # What the DPDP Act covers What the Digital Personal Data Protection Act does, which data and organisations it covers, and what it leaves out. Jump to the quiz ## Where things stand - Sections 1(2) and 2 have applied since 13 November 2025. Section 3 (scope) and section 17 (exemptions) start around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) paras (a) and (c) - No notification exempting startups or other classes under section 17(3), or under section 17(5), was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## A law for digital personal data The Digital Personal Data Protection Act, 2023 is Act No. 22 of 2023. The President assented on 11 August 2023. It governs how digital personal data is processed, recognising both a person's right to protect her data and the need to process it for lawful purposes. The Act has 44 sections and one Schedule of penalties. The detail sits in the Digital Personal Data Protection Rules, 2025, notified by MeitY as G.S.R. 846(E) on 13 November 2025. Most of the Act and Rules are not yet in force; lesson 12 gives the dates. Sources: Act preamble Act s.1 ## Personal data and processing Personal data is any data about an individual who is identifiable by or in relation to that data. Digital personal data is personal data in digital form. Processing is any wholly or partly automated operation on it, from collection and storage to use, sharing and erasure. Sources: Act s.2(t) Act s.2(n) Act s.2(x) ## Where the Act applies Inside India, the Act applies to digital personal data collected in digital form, and to data collected on paper and digitised later. Outside India, it applies when processing is connected to offering goods or services to people in India, such as a foreign app with Indian users. Two things are outside it. The first is data an individual processes for a personal or domestic purpose. The second is personal data made public by the person it relates to, or by someone legally required to publish it. The Act's own example is a blogger who shares her details on social media. Sources: Act s.3 ## Exemptions, at a high level Section 17(1) switches off most duties for listed cases. They are: enforcing legal rights or claims, courts and regulators doing their functions, preventing or investigating offences, approved mergers, and tracing a loan defaulter's assets. Even then, the Fiduciary stays responsible for compliance and must keep reasonable security safeguards. The Government may also notify State bodies for security and public order, and certain Fiduciaries, including startups, to be excused from some duties. Research, archiving and statistics are exempt only if no decision about a specific person is taken and the Second Schedule standards are met. Sources: Act s.17 Rules r.16 ## How it sits with other laws The Act adds to other Indian laws rather than replacing them. If a provision truly conflicts with another law, the DPDP provision prevails to that extent. When section 44(2) starts, around May 2027, it omits section 43A of the Information Technology Act, 2000. Sources: Act s.38 Act s.44(2) G.S.R. 843(E) ## Key points - Covers digital personal data, including paper records digitised later. - Reaches foreign firms offering goods or services to people in India. - Personal or domestic use and lawfully public data fall outside. - Exempt processing still needs security safeguards and accountability. - Adds to other laws; prevails only in a real conflict. ## In practice A checklist for your organisation. - List every system holding personal data, including scanned paper files. - Check whether group companies abroad serve people in India. - Record any section 17 exemption you rely on, with its reason. - Keep security controls in place even for exempt processing. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### A company scans old paper application forms into its document system. Does the Act apply to the scanned data? - No, because it was collected on paper - Yes, data collected on paper and digitised later is covered - Only after five years - Only if the forms were signed Show the answer **B. Yes, data collected on paper and digitised later is covered** Section 3(a)(ii) applies the Act to personal data collected in non-digital form and digitised subsequently. Act s.3(a) 2. Question 2 of 5 ### A company based abroad offers an app to users in India. When does the Act reach its processing outside India? - Only for government data - When the processing is connected to offering goods or services to people in India - Never - Only if it has an office in India Show the answer **B. When the processing is connected to offering goods or services to people in India** Section 3(b) extends the Act to processing outside India connected to offering goods or services to Data Principals in India. Act s.3(b) 3. Question 3 of 5 ### Which of these is outside the Act? - A hospital's patient records - A bank's customer database - An employer's payroll system - An individual keeping contacts for a personal or domestic purpose Show the answer **D. An individual keeping contacts for a personal or domestic purpose** Section 3(c)(i) excludes personal data processed by an individual for any personal or domestic purpose. Act s.3(c) 4. Question 4 of 5 ### Under section 17(1), which duties still apply to processing that is otherwise exempt? - Only the notice duty - Only breach reporting - Overall responsibility and reasonable security safeguards (s.8(1) and s.8(5)) - None at all Show the answer **C. Overall responsibility and reasonable security safeguards (s.8(1) and s.8(5))** Section 17(1) switches off Chapter II except sub-sections (1) and (5) of section 8: responsibility for compliance and reasonable security safeguards. Act s.17(1) 5. Question 5 of 5 ### A DPDP provision conflicts with a provision of another law. What happens? - Both provisions become void - The other law always wins - The DPDP provision prevails to the extent of the conflict - The parties choose Show the answer **C. The DPDP provision prevails to the extent of the conflict** Section 38(2) says the DPDP provision prevails to the extent of the conflict; section 38(1) otherwise keeps other laws in place. Act s.38 Try again[Next lesson: Who is who in the law](https://foctta.com/learn/the-roles) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← The course **All 12 lessons**](https://foctta.com/learn) [Lesson 2 → **Who is who in the law**](https://foctta.com/learn/the-roles) **In this lesson** 1. Where things stand 2. A law for digital personal data 3. Personal data and processing 4. Where the Act applies 5. Exemptions, at a high level 6. How it sits with other laws 7. Key points 8. In practice 9. Quiz Take the quiz