Digital Personal Data
Personal data in digital form. The Act also covers non-digital personal data once it is digitised.
Digital personal data is personal data held in electronic form. The DPDP Act regulates it, including paper data that is later typed or scanned into a system.
Meaning of Digital Personal Data
The Act applies to personal data collected online or offline, as long as it ends up in digital form. Personal data that is only ever kept on paper and never digitised is outside the Act. Processing that happens outside India is covered when it relates to offering goods or services to people in India.
Section 2(n) defines digital personal data as personal data in digital form. This is the only kind of personal data the Act regulates. Section 3(a) says the Act applies to processing of digital personal data within India when the data was collected in digital form, or collected in non-digital form and digitised afterwards. Purely paper records that never enter a computer are outside it.
The boundary is the moment of digitisation. A shop that writes visitor names in a register is not within the Act for that register. The day an assistant scans the pages, or types them into accounting software, the content becomes digital personal data and the shop, as a Data Fiduciary, must follow the Act for that data from then on, including notice, security and retention.
The Act also reaches beyond India's borders in one situation. Section 3(b) applies to processing of digital personal data outside India if it is connected with offering goods or services to Data Principals in India. A foreign streaming service or software provider that markets to Indian users cannot step around the Act by hosting servers elsewhere. The trigger is the offering of goods or services to people in India, so the wording of Section 3(b) is the test to apply.
Digital form is not limited to databases. Emails, cloud documents, mobile app logs, CCTV footage stored on a recorder, voice notes, scanned ID cards and photographs on a phone all qualify. Two exclusions in Section 3(c) still apply: personal or domestic use by an individual, and data made public by the Data Principal or under a legal obligation. Everything else in digital form falls within scope.
Examples of Digital Personal Data
A paper registration form is outside the Act until a clerk types it into a spreadsheet. From that moment, the spreadsheet is digital personal data.
A school collects admission forms on paper. When the office staff enter student and parent details into the school's management software, those details become digital personal data. The school provides a notice at the counter and applies the children's data rules to those records.
A software company based abroad sells a subscription app to Indian small businesses. Although its servers are outside India, it is processing digital personal data of users in India in connection with offering a service, so the Act applies to that processing.
A clinic gives patients a printed slip and keeps a notebook. Staff photograph the notebook pages weekly and share them in a group chat to prepare bills. The photographs are digital personal data, so the clinic moves to a secure billing tool with access controls.
Why Digital Personal Data matters
Because the Act applies only to digital personal data, scope is the first compliance question. Organisations that believe they are "mostly paper" are often surprised to find scans, WhatsApp photos of forms and spreadsheets made for convenience, which together bring large volumes of data inside the Act. The Schedule's penalties, up to ₹250 crore for weak security safeguards and ₹50 crore for most other breaches, apply to these digitised stores in the same way as to a modern cloud platform.
For individuals, it means the data they give on paper at a clinic, bank branch or school counter becomes protected once it is entered into a system. Protection does not depend on whether they used an app.
How it works in practice
- 1Map the points where paper becomes digital: front-desk registers, application forms scanned by a back office, data-entry vendors, photos of documents sent over messaging apps and call-centre notes typed in later.
- 2Decide who is the Data Fiduciary at each point and put a notice in front of the individual before or at collection, even when the first capture is on paper.
- 3Bring scanned folders and digital archives into the same retention schedule as database records, and erase them when the purpose ends under Section 8(7).
- 4Limit informal digital copies. Provide a secure upload or scanning workflow so that staff do not keep personal copies on phones or personal email.
- 5If you offer goods or services to people in India from outside the country, appoint a team to track Indian requirements and contact routes, because Section 3(b) applies to you.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Saying "we are a paper-based business, so the Act does not apply." Once any record is scanned, typed or photographed, it is covered.
Treating digitisation as a purely technical step. It creates new legal duties, so decide the notice, security and retention rules before it happens.
Believing offshore hosting removes Indian obligations. If you offer goods or services to people in India, Section 3(b) can apply wherever the servers are.
Forgetting informal digital copies such as photos in chat groups, which are among the first places a leak occurs.
Compliance tips
Create a short written rule on what staff may photograph or scan and where those files must be stored.
Include paper-to-digital steps in your data inventory so audits capture hybrid processes.
Review vendor data-entry arrangements. If an outsourced team keys in your forms, treat it as a Data Processor under a written contract.
Provide the privacy notice on the paper form itself so that people are informed at the first point of collection.
Common questions about Digital Personal Data
Does the DPDP Act apply to paper records?
Not while they stay on paper only. The Act covers digital personal data, which includes personal data collected on paper and then digitised. Once the paper record is scanned or typed into a system, the Act applies to that digital copy.
Is digital personal data the same as personal data?
Not exactly. Personal data is about any identifiable individual. Digital personal data is personal data in digital form, and it is the only form the Act regulates. Paper-only records are personal data but outside the Act.
Does the Act cover personal data stored outside India?
It covers processing outside India if it is connected with offering goods or services to people in India. Data stored abroad about Indian users for such a service is within reach of the Act, subject to Section 16 on cross-border transfers.
Are emails and chat messages digital personal data?
Yes, when they relate to an identifiable individual. Email content, contact lists and chat exports are digital in form. Whether they are regulated depends on who processes them and whether the personal or domestic exclusion applies.