Free · no signup · about a minute

Does any of this actually apply to you?

Most small companies assume compliance is for big tech. Five questions and you'll know whether India's DPDP Act or the EU AI Act reaches you — and exactly which duties follow if it does.

Do you collect any personal information from people?

What does this mean?

Anything that identifies a person — including a signup form, a booking, or an invoice.

e.g. a booking site that takes a name, an email and a card = Names, Email addresses and Payment details.

NamesEmail addressesPhone numbersPostal addressesPayment or card detailsLocation dataNone of these

Are any of those people in India?

What does this mean?

India's DPDP Act applies to organisations anywhere in the world that handle the personal data of people in India.

e.g. if someone in Mumbai can sign up and pay you, the answer is Yes — even if your company is registered elsewhere.

YesNo

Do you build or use any AI or automated decision-making system?

What does this mean?

A model that recommends, scores, ranks, screens or decides — whether you built it or bought it.

e.g. a recommendation feed, a CV screener, or an LLM chatbot = Yes. A plain booking form with no model = No.

YesNo

Is that product, or its output, used by anyone in the EU?

What does this mean?

The EU AI Act reaches organisations outside the EU when the system's output is used inside it.

e.g. if a customer in Germany can use the feature, the answer is Yes.

YesNo

Do you handle the data of children under 18?

What does this mean?

Under DPDP a child is anyone under 18 — a higher age than many other laws.

e.g. if your terms say 18+ and you never knowingly sign up a minor, the answer is No. A tutoring app answers Yes.

YesNo

An indicative scope check, not a legal determination. Nothing you enter here is stored.