Applicability
DPDP Act for ecommerce businesses: checkout, retention and vendors
Apply the DPDP Act to checkout, fulfilment, returns, marketing and vendors, including the special retention rules for large ecommerce platforms.
Category
DPDP articles on applicability
8 articles on this site are filed here. Open any of them for the source documents behind their legal claims, with a claim type label on every source.
Applicability
DPDP Act for fintech companies: roles, consent and sector rules
Map each fintech data flow by purpose and means, then apply consent, contracts, the loan default exemption, retention, the RBI draft and live IRDAI rules.
Applicability
DPDP Act for hospitals, clinics and health apps: what applies
The DPDP Act has no health data category, and section 7, not in force until a computed 13 May 2027, names no routine treatment clause. That date is interpretation until officially confirmed. On this site's reading, consent and 3 legitimate uses do most of the work; plus child patient relief, the guardian gap, records and the SPDI Rules meanwhile.
Applicability
DPDP and AI: the English text never names it, and public data is not a free pass
English Act and Rules text names AI, machine learning and profiling 0 times. Section 3 starts on computed 13 May 2027, interpretation until officially confirmed.
Applicability
Section 17 of the DPDP Act: what the exemptions actually switch off
Section 17(1) is not in force: from a computed 13 May 2027 it disapplies Chapter II except sections 8(1) and 8(5), Chapter III and section 16. It reaches only the 6 situations in clauses (a) to (f). The verified clause by clause map, with that date interpretation until officially confirmed.
Applicability
Does DPDP apply to B2B SaaS companies?
Main DPDP duties are not in force. Once they commence, a B2B SaaS can be a fiduciary when it sets purpose and means, or a processor on behalf of a customer.
Applicability
Does DPDP apply to foreign companies?
Section 3(b), not in force yet, reaches processing outside India in connection with any activity related to offering goods or services to people in India. The Act creates no local presence duty beyond the India based Data Protection Officer of a notified Significant Data Fiduciary, and section 37 blocking, in the same 18 month group, is the route against a company with no Indian assets.
Applicability
Does the DPDP Act apply to startups? No size test, and 3 places size counts
Section 3 carries no turnover, headcount or user threshold, so a 2 person company is inside the Act once section 3 commences on a computed 13 May 2027. That date is interpretation until officially confirmed. Size still decides which duties bite, in 3 named places, and section 17(3) names startups without exempting a single one.
The provisions these articles point to
Each page carries the official text of the provision, its commencement status and the sources behind it.
- Section 3: Application of Act
- Section 7: Certain legitimate uses
- Section 8: General obligations of Data Fiduciary
- Section 17: Exemptions
- Section 37: Power of Central Government to issue directions
- Rule 8: Time period for specified purpose to be deemed as no longer being served
- Rule 12: Exemptions from certain obligations applicable to processing of personal data of child
- Rule 16: Exemption from Act for research, archiving or statistical purposes
- Second Schedule: standards for State processing and for research, archiving or statistical purposes
Tools for this topic
Free, no login, and each one shows the provisions its answers rest on.