InfraVeritas360DPDPiqDPDP Insights › The law › Section 3
The law
Section 3: Who the Act covers
The Act covers digital personal data processed in India, and paper records once they are digitised. It also covers organisations abroad that offer goods or services to people in India.
What it means in your sector
- IT, ITeS, BPO and GCC: Data you process in India is covered. Data of people outside India processed under a foreign contract has a special exemption in Section 17(1)(d).
- Healthcare and hospitals: Paper case files, consent forms and registers are covered once scanned into the hospital system.
Questions where this section matters
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.