Glossary
What is digital personal data under DPDP?
The DPDP Act regulates personal data in digital form. Paper records come in once they are digitised.
Definition
Under s.2 of the DPDP Act, 2023, digital personal data is personal data in digital form. The Act applies to digital personal data processed in India, whether collected in digital form or collected otherwise and digitised (s.3). It also applies to processing outside India connected with offering goods or services to Data Principals in India.
What it means
A form filled in on an app is covered from the start. A paper form is covered once it is scanned or typed into a system.
The Act also reaches processing outside India when it is connected with offering goods or services to Data Principals in India (s.3). The DPDP Act overview explains the scope and its exclusions.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines digital personal data |
| s.3 | Covers data collected digitally, or collected otherwise and digitised |
| s.3 | Covers processing outside India connected with offering goods or services in India |
| s.3 | Excludes personal or domestic purposes, and data made publicly available by the Data Principal or under a legal obligation |
| s.17(1)(d) | Data of Data Principals outside India processed in India under a contract with a person outside India: Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 do not apply |
Common misconceptions
- “Paper records are never covered.” They are covered once digitised (s.3).
- “Only servers in India count.” Processing outside India connected with offering goods or services to Data Principals in India is covered (s.3).
- “Offshore client data processed in India is fully covered.” s.17(1)(d) disapplies Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 for such processing; see BPO and GCC and check with counsel.
Related terms
Data about an individual identifiable by or in relation to it (s.2).
ProcessingAny wholly or partly automated operation on digital personal data (s.2).
Cross-border transferTransfer of personal data outside India (s.16, Rule 15).
Data FiduciaryDecides the purpose and means of processing personal data (s.2).
In TruePrivacy
TruePrivacy finds digital personal data where it sits: connectors for sources including SQL databases, MongoDB, Amazon S3, Azure Blob Storage, Google Drive, Slack and Zendesk, and a DSPM endpoint agent for macOS, Windows and Linux that scans local files on enrolled employee devices. Findings carry masked samples, not the raw files.
Does DPDP apply to paper records?
Only once they are digitised. s.3 covers personal data collected in digital form, or collected in non-digital form and digitised later.
Does DPDP apply to a company outside India?
It applies to processing outside India that is connected with offering goods or services to Data Principals in India (s.3).
Is a BPO in India covered for foreign clients' data?
s.17(1)(d) exempts processing in India of personal data of Data Principals outside India, under a contract with a person outside India, from Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16. Check the scope with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin