Section 3: Application of the Act

Statutory Text (Official Gazette)

Subject to the provisions of this Act, it shall—

• (a) apply to the processing of digital personal data within the territory of India where the personal data is collected—
  • (i) in digital form; or
  • (ii) in non-digital form and digitised subsequently;
• (b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;
• (c) not apply to—
  • (i) personal data processed by an individual for any personal or domestic purpose; and
  • (ii) personal data that is made or caused to be made publicly available by—
    • (A) the Data Principal to whom such personal data relates; or
    • (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

Illustration.—X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

What Section 3 Means in Plain English

Section 3 defines the operational boundaries of the DPDP Act:

1. Digital data focus: The law regulates all data collected online (via websites, cookies, mobile apps, SaaS tools, and APIs) as well as offline paper records that are subsequently scanned or keyed into digital databases.
2. Extra-territorial reach: Even if your company is headquartered in Delaware, London, Dubai, or Singapore, the DPDP Act applies to you if your processing is connected to offering goods or services to people in India. The final Act dropped the 2022 draft bill’s separate “profiling” trigger, so tracking Indian visitors with no goods or services offered to them is not, by itself, enough to bring a foreign company into scope. In practice, almost any site that sells to or serves Indian users is covered.
3. What is exempt:
   • Purely personal or domestic activities (such as your personal smartphone contact book).
   • Data that an individual deliberately made public (e.g., public LinkedIn profiles, personal blogs, or YouTube videos created by the individual).