Does Our Business Have to Comply with DPDP, or Not? Clearing the Fog for B2C and B2B Companies in India
Three sentences come up in almost every conversation we have about India's data protection law. All three feel reasonable. None of them is true.
● “We are a B2B company. We don't hold data of the public, so this law isn't for us.”
● “We are too small. Surely there is a turnover limit or an employee threshold.”
● “Our data sits with our cloud provider and our software vendor. It is their responsibility.”
The confusion is understandable. The Digital Personal Data Protection Act, 2023 is written in the language of “data fiduciaries” and “data principals,” not in the language of businesses. Most commentary jumps straight to penalties and consent banners without ever answering the first question a business owner actually has: does this even apply to me, and if yes, how much of it?
This article answers exactly that. It is split into two parts, because B2C and B2B companies genuinely face different versions of the same law. Part 1 covers businesses that serve individuals. Part 2 covers businesses that sell only to other businesses, where the fog is thickest.
Start with the test below. It takes half a minute.
The thirty-second scope test
| The check | Where to look | If the answer is yes |
|---|---|---|
| 1. Do you employ anyone in India? | Payroll file, attendance system, PF and ESI records, bank details of staff | You hold personal data. You are a Data Fiduciary for your own workforce. |
| 2. Do you receive CVs or applications? | HR mailbox, applicant tracking system, WhatsApp forwards from consultants | Applicants are Data Principals, including the ones you rejected. |
| 3. Does your website collect anything? | Contact form, demo request, newsletter, chatbot, cookie and analytics scripts | Every submission is personal data collected by you. |
| 4. Do you store names of people at client or vendor companies? | CRM, purchase orders, site visit logs, email signatures saved into a database | A person at another company is still a person. Their name and number are personal data. |
| 5. Do you run CCTV or a digital visitor register? | DVR at the gate, visitor tablet at reception, biometric attendance device | Footage and biometric records identify individuals. In scope. |
IF YOU ANSWERED YES EVEN ONCE
You are a Data Fiduciary under the DPDP Act. There is no turnover threshold, no headcount threshold and no industry exclusion. The remaining question is not whether you must comply, but how much work that actually means for a business shaped like yours. That is what the rest of this article maps out.
What actually counts as “personal data”
Personal data is any data about an individual who can be identified from it, or from it combined with something else you hold. That is a wider net than most people picture.
● Obvious: name, mobile number, email address, postal address, photograph, PAN, Aadhaar number, bank account details.
● Less obvious: employee code linked to a person, CCTV footage, biometric punch records, GPS location of a delivery, IP address, device identifier, cookie ID, a voice recording on a support call.
● Often missed: a spreadsheet of “leads”, a WhatsApp group of customers, an old marketing list bought from an agency, a test database copied from production.
Two limits are worth knowing. First, the Act covers personal data in digital form, plus paper records that are later digitised. A physical register that never gets scanned sits outside. Second, the law is about individuals, not companies. A company's GST number or its registered office address is not personal data. The name, designation and mobile number of the procurement manager at that company is.
What the law reaches, and what it genuinely does not
Four carve-outs get quoted often, and each one is narrower than it sounds:
Purely personal or domestic use. Your own contact list on your own phone. Not your company's contact list on a company laptop.
Publicly available data. Data the individual made public themselves, or that someone is legally obliged to publish. Scraping a professional network and calling it “public” does not automatically qualify, and the moment you combine it with other data you are back in scope.
Foreign data processed under a foreign contract. This is the outsourcing carve-out. If an Indian company processes the personal data of individuals outside India, under a contract with an entity outside India, large parts of the Act do not apply to that processing. But two duties survive even here: overall accountability for the processing, and the obligation to keep the data secure. And the moment the same operation touches an Indian individual's data, the carve-out stops covering it.
Research, archiving and statistical purposes. Partial relief only, subject to prescribed standards, and only where the processing is not used to make a decision about a specific individual.
The Act also allows the government to notify classes of data fiduciaries, including startups, for relief from some obligations. That door exists on paper. Until a notification actually names your class, it is not a plan.
The single most useful idea in this article
Personal data is not the same thing as customer data.
Almost every business that believes it is out of scope has made the same substitution in its head: it heard “personal data” and thought “consumer data.” Once you separate the two, the picture becomes obvious.
Figure 3: The category almost everyone worries about is the one the fewest businesses actually hold.
Employees come first, not customers. A hundred percent of operating businesses hold employee data. That alone settles the applicability question for the vast majority of Indian companies, regardless of who they sell to.
With that established, the real question becomes one of degree. The rest of this article is organised into two parts, because the answer differs sharply depending on which side of the market you sit.
PART ONE
Businesses that serve individuals (B2C)
If you sell to individuals, you are in scope and you already suspected it. What businesses in this bucket usually underestimate is the number of separate parties that end up touching the same personal data, and the fact that the accountability for all of them stays in one place: with you.
Three worked examples follow, from three different sectors. The pattern repeats in all of them.
Example 1: An online food delivery aggregator
A person opens the app, enters their name, mobile number, flat address and a GPS pin, and pays online. From the customer's point of view, one company took an order. From the law's point of view, a chain of parties just came into existence.
| Party | Role under DPDP | What this means in practice |
|---|---|---|
| The customer | Data Principal | Can ask what you hold, ask for correction, withdraw consent, demand erasure and complain to the Board. |
| The delivery platform | Data Fiduciary | Decides what is collected and why. Accountable for the entire chain, including everyone below. |
| Cloud hosting provider | Data Processor | Handles data only on the platform's instructions. Needs a contract covering security, sub-processors, breach notice and deletion on exit. |
| Payment gateway | Its own Data Fiduciary | Determines its own purposes for card and transaction data under financial regulation. Not simply your processor, so the notice must tell the customer this hand-off happens. |
| Delivery rider app | Processor, and a Fiduciary for its riders | Receives customer name, phone and location. Separately holds its riders' own personal data, which is its own obligation. |
| SMS, push and email gateway | Data Processor | Receives phone numbers and names for every order update. Frequently forgotten in vendor registers. |
| Restaurant partner | Its own Data Fiduciary | Receives name and often contact details. Runs its own systems and must be told what it may and may not do with the data. |
| Analytics and advertising tools | Data Processor | The highest-risk category, because marketing teams add them without telling IT. Each one is a data flow. |
Verdict: fully in scope, at the heavy end. High volume, location data, payment data, a long vendor chain, and a realistic chance of being designated a Significant Data Fiduciary.
Example 2: A diagnostics and pathology lab chain
A patient books a blood test online, a phlebotomist visits their home, samples go to a central lab, and a report lands on a patient portal and a WhatsApp number. Health data is involved at every step, and health data raises the stakes on everything: security, retention, and who inside the organisation can see what.
| Party | Role under DPDP | What this means in practice |
|---|---|---|
| The patient | Data Principal | Has rights over records that are among the most sensitive a business can hold. |
| The lab chain | Data Fiduciary | Notice and consent at booking, tight access control on reports, a clear retention period, and breach readiness. |
| Lab information system vendor | Data Processor | Hosts the clinical records. Contract must cover security, sub-processors and what happens on termination. |
| Home collection field staff app | Processor, plus employee data of its own | Location, patient address and phone move through a mobile device that leaves the premises. |
| Referring doctor or hospital | Its own Data Fiduciary | A separate organisation with its own obligations. Sharing needs a basis and a record. |
| WhatsApp or SMS report delivery | Data Processor | Convenient, and a common source of accidental disclosure to the wrong number. |
| Insurance or corporate wellness client | Its own Data Fiduciary | Results shared for a corporate health check belong to a different accountability chain. Consent must cover it explicitly. |
Verdict: fully in scope, at the heavy end. Health data, minors in family health packages, long retention expectations under medical rules, and severe consequences if a report reaches the wrong person.
Example 3: An exam preparation app used by school students
A coaching platform signs up students in Class 9 to Class 12. A parent pays. The student uses the app daily. The platform tracks watch time, test scores and weak topics, and the marketing team retargets lapsed users with advertisements.
This example is included deliberately, because it contains the one trigger that changes the rules entirely: some of these users are children.
| Element | Role or issue | What this means in practice |
|---|---|---|
| The student under 18 | Data Principal, and a child | Verifiable parental or guardian consent is required before processing. |
| The paying parent | Data Principal, and the consenting guardian | You must be able to show how you verified that this adult is the guardian. |
| The platform | Data Fiduciary | Carries the highest penalty band that applies to children's data obligations. |
| Behavioural tracking of study patterns | Restricted | Tracking, behavioural monitoring and targeted advertising directed at children are prohibited, with narrow conditional exemptions for specified classes and purposes. |
| Retargeting ads to lapsed students | High risk | This is precisely the practice the children's provisions are aimed at. |
| Video and voice in live classes | Sensitive | Recordings of identifiable minors need explicit purpose, tight access and a hard retention limit. |
| Teachers and freelance tutors | Employee and contractor data | A second, separate fiduciary obligation running alongside the student one. |
Verdict: fully in scope, at the heaviest end. Any business whose users include people under 18 should treat children's data as a design constraint, not a compliance clause.
What a B2C footprint actually looks like
This is worth pausing on. A B2C company that builds a beautiful consent flow for customers and forgets its riders, its employees and its applicants has covered about half the problem. The obligations are identical for every slice.
The B2C compliance load, in one list
● A clear, standalone notice at every point where data is collected, in plain language and in the languages your users actually read.
● Granular consent. Service delivery and marketing are separate purposes and need separate permissions.
● Withdrawal that works as easily as signing up, and that actually stops downstream processing.
● A rights request channel that can cope with volume, because consumer businesses get consumer volumes of requests.
● Retention limits that are enforced, not just documented. Certain large e-commerce, online gaming and social media platforms carry a specific three-year rule with advance notice before erasure.
● A vendor register covering every processor in the chain, with signed data protection terms.
● Breach readiness, including a detailed report to the Board within 72 hours.
● Children's provisions if any user can be under 18, whether or not you intended that.
PART TWO
Businesses that sell only to other businesses (B2B)
This is where the fog is thickest, and the confusion is honest. A company that manufactures industrial valves and sells to three hundred factories genuinely does not hold a database of the public. The instinct that “this law is about consumer apps” is not stupid. It is just wrong about how the law is written.
The law does not ask whether your customers are individuals. It asks whether you process personal data. Here is where a typical B2B company's personal data actually sits.
Thirty-six percent employees. Twenty-one percent named contacts at client companies. Fifteen percent job applicants. Zero percent consumers. Total obligation: full.
The two hats problem
Every B2B company wears two hats at the same time, and mixing them up is the most common mistake in this bucket.
| Question | When you wear the Fiduciary hat | When you wear the Processor hat |
|---|---|---|
| Who decides why the data is used? | You do | Your client does |
| Who must give notice to the individual? | You | Your client |
| Who answers a rights request? | You | Your client, with your cooperation |
| You | Your client stays accountable, and will pass the obligations to you by contract | |
| Who must keep the data secure? | You | You, under the contract, and as a matter of basic duty |
| Who decides retention and deletion? | You | Your client instructs, you execute and evidence it |
| What happens on a breach? | You notify the Board and the individuals | You notify your client, fast, and help them meet their clock |
THE PRACTICAL CONSEQUENCE FOR B2B
Even where you are “only a processor” for client data, you are always a fiduciary for your own employees, applicants and business contacts. There is no configuration of a B2B business in which the law simply does not apply. What varies is how heavy the load is, not whether it exists.
Example 4: An industrial equipment manufacturer
Sells machinery to factories. No app, no consumers, no marketing to the public. A sales team of forty, a dealer network across six states, and a service engineering team that visits client sites. The management is convinced DPDP is somebody else's problem.
| Where the data is | Who the individuals are | Obligation triggered |
|---|---|---|
| Payroll, attendance, PF records | Employees and contract workers | Full fiduciary duties: notice, security, retention, rights, breach |
| Biometric attendance at the plant gate | Employees, contractors, drivers | Biometric data needs tight access control and a retention limit |
| CCTV across plant and warehouse | Anyone who walks in | Footage is personal data.Retention and access must be defined |
| CRM with purchase managers and plant heads | Individuals at client companies | Their names, numbers and emails are personal data you control |
| Dealer and channel partner records | Dealer principals, their sales staff | Personal data of people at partner firms, often shared onward |
| Service call logs with site engineer details | Client-side engineers, your own field staff | Often includes location and photographs from site visits |
| CV inbox and recruitment consultants | Applicants, including rejected ones | A large, undocumented store in most manufacturers |
| Visitor register app at reception | Visitors, drivers, auditors | A digital record that identifies individuals |
Verdict: in scope, at a moderate load. No consumer volume, no children's data, no sensitive categories at scale. But a real inventory, real vendor contracts, real retention rules and a real breach plan are all required.
Example 5: A B2B SaaS and IT services company
Builds and operates software for enterprise clients. Some clients are Indian banks and manufacturers. One large client is an overseas insurer whose end-customers are all outside India. The company also runs its own marketing website and hires aggressively.
This is the most confused profile of all, because all three situations coexist inside one organisation.
| Data stream | Role | What applies |
|---|---|---|
| Own employees, contractors, applicants | Data Fiduciary | Everything. This is the part most IT companies overlook entirely. |
| Website leads, demo requests, event lists | Data Fiduciary | Notice and consent at capture, marketing consent kept separate, deletion on request. |
| Indian client's production data hosted by you | Data Processor | Duties flow from the client contract. Expect audit clauses, breach timelines and deletion obligations. |
| Support tickets containing end-user details | Data Processor | A commonly missed store. Attachments in a ticketing tool are personal data. |
| Test and staging copies of client data | Data Processor, high risk | Real personal data in an environment with weak controls is the classic breach story. |
| Overseas client, data of individuals outside India, contract with a foreign entity | Carve-out applies, partially | Large parts of the Act do not apply to that specific processing. Accountability and the duty to keep it secure still do. The carve-out covers the foreign data only, never the rest of your company. |
| Same overseas client's Indian users, if any | No carve-out | As soon as an Indian individual's data enters the same pipeline, ordinary obligations return. |
Verdict: in scope, with a moderate to high load. The export carve-out is real but narrow, and it protects one processing stream, not the organisation.
What changes for B2B companies in practice
● Your client contracts change first. Expect DPDP clauses, security schedules, breach notification windows measured in hours, deletion obligations and audit rights.
● You will be audited by customers long before any regulator looks at you. Enterprise procurement now asks for evidence, not assurances.
● Employee data becomes a live obligation, including the ex-employee records sitting in an old HR folder.
● Your own vendor chain needs papering: the HR platform, the payroll firm, the recruitment consultant, the cloud provider, the CCTV AMC vendor.
● Marketing must stop treating scraped or purchased contact lists as free inventory.
● Deletion becomes a contractual event. When a client leaves, you must be able to prove the data went with them.
So how much do you actually have to do?
Applicability is binary. Effort is not. The chart below places common Indian business types on a rough ten-point scale of compliance load.
| Business type | What drives the load | Depth | First three actions |
|---|---|---|---|
| Consumer app or marketplace | Volume, location, payments, long vendor chain | Heavy | Map data flows, rebuild consent, paper every processor |
| Healthcare and diagnostics | Sensitivity, access control, sharing with third parties | Heavy | Access review, retention rules, report delivery controls |
| Edtech or anything used by minors | Children's provisions and advertising restrictions | Heavy | Age assurance, guardian consent, stop child-directed tracking |
| BFSI and lending | Volume, financial data, sectoral regulation on top | Heavy | Align DPDP with RBI and CERT-In obligations, consent records |
| D2C e-commerce and retail | Customer volume, marketing tools, loyalty data | Moderate to heavy | Audit the marketing stack, fix consent, set retention |
| B2B SaaS and IT services | Two hats, client contracts, test data | Moderate | Separate fiduciary and processor data, fix client contracts |
| B2B manufacturing and distribution | Employees, CCTV, dealer network, CRM | Moderate | Inventory HR and CCTV, write retention, paper key vendors |
| Professional services firms | Client contact data, candidate data, confidentiality | Moderate | Inventory, access control, engagement letter clauses |
| Small B2B services firm | Employees and a handful of systems | Light | One spreadsheet inventory, basic security, a named owner |
| Export-only BPO | Foreign data under a foreign contract | Light, but never zero | Prove the carve-out applies, keep security and accountability |
Do we need to buy a DPDP tool?
This is the second most common question after applicability, and it deserves a direct answer: no business is required by law to buy software. What the law requires is outcomes. Software becomes necessary at the point where producing those outcomes by hand stops being realistic.
| If this describes you | What you actually need | What you do not need yet |
|---|---|---|
| Under 50 staff, under 10 systems, no consumer data | A one-page policy, a spreadsheet inventory, a named owner, basic security hygiene | A privacy platform, a consultant retainer, a DPO appointment |
| Mid-sized, 10 to 30 systems, several departments | A maintained register, standard vendor clauses, a rights request inbox with an owner and an SLA | Enterprise-grade automation, unless growth is fast |
| Consumer-facing, or millions of records, or heavily regulated | Automated discovery, consent lifecycle with proof, DSAR workflow, scheduled deletion, evidence trail | Nothing. This is where manual approaches genuinely fail |
| Likely to be designated a Significant Data Fiduciary | All of the above, plus DPIA capability, an India-based DPO and an annual independent audit | Delay. The clock starts on designation, not on readiness |
Six sentences that will not save you
The most dangerous of the six is the third one, about size. People assume every Indian compliance regime has an MSME threshold hiding somewhere. This one does not. A five-person design studio with a payroll and a contact form is a Data Fiduciary, exactly like a listed company. What differs is that the studio's entire compliance programme might fit on two pages, while the listed company needs a platform and an audit.
Five things that quietly raise your load
| Trigger | Why it changes the answer |
|---|---|
| Any user might be under 18 | Verifiable guardian consent applies, tracking and targeted advertising at children are restricted, and the penalty band for children's obligations is among the highest. |
| You process health, financial or biometric data | Not a separate legal category under this Act, but the practical bar for security, access control and retention rises sharply, and sectoral regulators add their own requirements. |
| You hold data at very large scale | Volume is one of the factors for designation as a Significant Data Fiduciary, which brings an India-based DPO, an independent auditor, an annual DPIA and audit, and algorithmic due diligence. |
| Data leaves India | Transfers are permitted except to territories the government restricts, but you must know where data actually sits before you can answer the question at all. |
| You are in a listed retention class | Certain large e-commerce, online gaming and social media intermediaries face a specific three-year deletion rule with advance notice to the individual. |
A fifteen-minute self-assessment
Score one point for each statement that is true today. Answer honestly rather than aspirationally.
| # | Statement | Point |
|---|---|---|
| 1 | We know exactly which systems hold personal data, and the list is written down | 1 |
| 2 | Someone by name owns data protection here, and knows it | 1 |
| 3 | We know who our data processors are and have data protection terms with the top ten | 1 |
| 4 | Our privacy notice matches what we actually do, not what a template said | 1 |
| 5 | Marketing consent is captured separately from service consent | 1 |
| 6 | A person can ask us for their data through a channel we monitor | 1 |
| 7 | Every category of data has a retention period that is actually enforced | 1 |
| 8 | Ex-employee and rejected-applicant data is deleted on a schedule | 1 |
| 9 | We know whether any of our users could be under 18 | 1 |
| 10 | We know which of our systems store data outside India | 1 |
| 11 | We could produce a breach report within 72 hours starting tonight | 1 |
| 12 | We have evidence, dated, that we have been doing all of this | 1 |
| Score | Where you stand | What to do next |
|---|---|---|
| 0 to 3 | Not started | Do the thirty-second test with your leadership team, then build the inventory. Nothing else matters until that exists. |
| 4 to 7 | Aware but exposed | You have pieces. Connect them: one owner, one register, one rights channel, vendor contracts for the top ten. |
| 8 to 10 | Substantially ready | Close the specific gaps, then shift focus to evidence and to making the habits recur quarterly. |
| 11 to 12 | Audit-ready | Move to proving it: dated evidence, a review calendar, and readiness for a customer or regulator asking to see it. |
Your first thirty days, by bucket
| Week | If you are B2C | If you are B2B |
|---|---|---|
| Week 1 | Name an owner. List every consumer-facing collection point: app, site, kiosk, call centre, WhatsApp. | Name an owner. Start with HR, payroll, CCTV, visitor system and the CV inbox. |
| Week 2 | Map the downstream chain: payments, delivery, notifications, analytics, ad tech. | List every client engagement where you touch their data, and separate it from your own data. |
| Week 3 | Rewrite notice and consent at the top three collection points by volume. | Pull out the top ten vendor contracts and check for data protection terms. |
| Week 4 | Stand up a rights request channel and test it as a customer would. | Write the retention rule for employee, applicant and CCTV data, and set a deletion date. |
The short version
If you employ people in India, you are in scope. Everything after that is a question of degree, and degree is something you can size in an afternoon.
B2C businesses carry the heavier load because of volume, sensitivity and the length of their vendor chains. B2B businesses carry a lighter but very real load, driven almost entirely by employee data, business contacts and the contracts their clients are about to hand them. Neither bucket contains an exit.
The businesses that will struggle are not the ones with the most data. They are the ones still arguing about whether the law applies while their customers have already started asking for evidence.
ABOUT VAULTDEF
VaultDef is a DPDP compliance platform built for Indian organisations: automated data discovery and classification, RoPA and data mapping, consent and notice management, data principal rights, breach workflow, DPIA, vendor and cross-border tracking, cookie consent, and a tamper-evident evidence trail. Whether you sit in the B2C or the B2B bucket, the starting point is the same: find out what you actually hold.
Request a scoping session at vaultdef.com
Frequently asked questions
Is there a minimum turnover or employee count below which DPDP does not apply?
No. The DPDP Act has no size threshold. A sole proprietor with a payroll and a website contact form is a Data Fiduciary. Size affects how much work compliance takes, not whether it applies.
We are a B2B company with no consumer data. Are we really covered?
Yes. Employee data alone brings you in scope, and most B2B companies also hold applicant data, named contacts at client and vendor firms, website leads and CCTV footage.
Is the name and mobile number of a client's procurement manager personal data?
Yes. The law protects individuals, not companies. The fact that the individual is acting in a professional capacity does not remove the data from scope.
Our data is on a global cloud platform. Does that make them responsible?
No. A cloud provider is typically a Data Processor acting on your instructions. Accountability for the processing stays with you, which is why the contract with them matters.
We only process data for our overseas parent or client. Are we exempt?
Partially, and only for that specific processing. Where the individuals are outside India and the contract is with an entity outside India, large parts of the Act do not apply, but accountability and the duty to secure the data remain. Any Indian individual's data in the same operation is fully in scope.
Does the Act cover paper files?
Only once they are digitised. A register that stays on paper and is never scanned or keyed in sits outside the Act, though other laws may still apply.
Do we have to buy a DPDP tool to be compliant?
No. The law requires outcomes, not products. Small organisations with few systems can meet those outcomes with disciplined manual records. Software becomes necessary when scale makes manual proof unrealistic.
Are we a Significant Data Fiduciary?
Only if the Central Government notifies you as one, based on factors including the volume and sensitivity of data you process and the risk to individuals. Large consumer platforms, banks and health-tech businesses should prepare in advance rather than wait.
What happens if we simply do nothing?
The Data Protection Board is already constituted and can act on a complaint. Separately, and sooner, enterprise customers are making DPDP evidence a condition of doing business.
