Every organisation. No threshold.
Size affects how much must be done. It does not affect whether the law applies.
- CATEGORY
- Insight · Applicability
- BRIEFING DATE
- 25 Sep 2026
- SOURCE
- DPDP explained plainly (25 Sep 2026), §03–04; DPDP Readiness Briefing (22 Sep 2026), p. 2
Every organisation that processes digital personal data in India, and every organisation abroad that offers goods or services to people in India. The Act contains no turnover threshold, and no exemption for private, unlisted or business-to-business companies.
Size affects how much must be done. It does not affect whether the law applies.
“We hold no consumer data.”
A company that sells only to other companies still holds personal data on its employees and their families, job applicants, directors, shareholders, vendor and customer contacts, visitors, and the people on its CCTV footage. All of it falls within the Act.
Three terms carry the whole Act
- Data PrincipalThe individual the data is about: a customer, employee, job applicant, patient, shareholder, or the contact person at a vendor.
- Data FiduciaryThe organisation that decides why and how the data is used, including setting the purpose and means of processing. The Act places its duties, and its penalties, here.
- Data ProcessorAnyone who handles the data on your behalf: the payroll provider, cloud host, CRM vendor, call centre, marketing agency, or outsourced IT.
Excerpts from Trayambic’s DPDP briefings. Dates are those of the source briefing. General information on the Act and Rules as understood in September 2026. It is not legal advice.
The DPDP Removal of Difficulties Order: What Moves, What Doesn't
The October 2026 order under section 43 of the DPDP Act rewrites two clauses, gives its reasons and leaves every date, rule and penalty exactly where it was.
Deepfakes and Synthetic Content: The 2026 IT Rules for Business
India's February 2026 amendment puts the labelling and takedown duties on intermediaries, but any business that clones a face or a voice also answers to the DPDP Act for the person it depicts.
Seven Months to Go: A DPDP Milestone Tracker to 13 May 2027
Consent managers arrive on 13 November 2026 and the main DPDP obligations on 13 May 2027, with sector deadlines in between and a Board with no members as of the latest official statement, so here is a dated tracker and a month-by-month plan.