The Act applies to processing of digital personal data within India — including data collected offline and later digitised — and it can also apply to processing outside India when it's connected to offering goods or services to people in India.
Who this could affect
Businesses
Customer, employee, vendor, and prospect information can all involve personal data.
Freelancers
Client databases, mailing lists, enquiry forms, and customer records may involve personal data.
Websites
Contact forms, account registrations, and customer portals can all involve personal data.
SaaS companies
User accounts, customer databases, and application activity can involve personal data.
Marketing agencies
Lead databases, campaign audiences, and customer information may involve personal data.
E-commerce
Names, addresses, phone numbers, accounts, and order information may involve personal data.
When it doesn't apply
The Act carves out specific exclusions — including personal data processed by an individual purely for personal or domestic purposes, and certain data the Data Principal has already made publicly available (or that another person is legally required to make public).
The fact that information is publicly available doesn't automatically remove every obligation in every situation — the precise circumstances still matter.