Chapter I · Preliminary
Section 3: Application of the Act
Section 3 sets the boundaries: it applies to digital personal data processed in India, and to processing abroad that targets people in India, while carving out personal or domestic use and data already made public.
- Chapter
- Chapter I · Preliminary
- Status
- Enacted · phased commencement
- Full compliance
- 13 May 2027
- Applies to
- Scope-setting
- Official citation
- DPDP Act, 2023, s.3
- Reading time
- 5 min
- Updated
- August 2026
At a glance
Section 3 fixes the scope of the DPDP Act. It applies to processing of digital personal data within India, and, importantly, to processing outside India where it relates to offering goods or services to people in India. It does not apply to personal data processed for a purely personal or domestic purpose, or to personal data the individual has made publicly available (or that is public under a legal duty).
Key takeaways
- Applies to digital personal data processed within India, whether collected digitally or digitised later.
- Has extra-territorial reach: it covers processing outside India connected to offering goods or services to people in India.
- Does not apply to data processed for a purely personal or domestic purpose.
- Does not apply to personal data the individual has made publicly available, or that is public under a legal obligation.
- If you serve Indian users from anywhere, assume the Act reaches you.
Who should read this
Read this if you are deciding whether the Act applies to your organisation at all, especially if you are based outside India but have Indian users, or if you rely on publicly available data.
In plain language
Section 3 answers a simple question: does the Act apply to what I am doing? Within India, it applies to the processing of digital personal data, data collected in digital form or collected on paper and later digitised.
Its reach does not stop at the border. If an organisation outside India processes personal data in connection with offering goods or services to people in India, the Act applies to that processing too. A foreign app or store with Indian users cannot ignore it.
Two carve-outs matter. Processing for a personal or domestic purpose is outside the Act, your private contacts list is not regulated. And personal data that the individual has made publicly available themselves, or that is public because a law requires it, is also outside scope.
The text of the law
Section 3: Application of the Act
Within India The Act applies to the processing of digital personal data within the territory of India where such data is collected in digital form, or in non-digital form and digitised subsequently.
Outside India It applies to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to the offering of goods or services to Data Principals within the territory of India.
Not applicable It does not apply to personal data processed by an individual for any personal or domestic purpose; or to personal data made or caused to be made publicly available by the Data Principal to whom it relates, or by any other person under a legal obligation to make it public.
Wording reproduced or summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- If you are based outside India but serve Indian users, treat yourself as in scope and plan accordingly.
- Do not assume "public" data is free to use, the carve-out is narrow and turns on who made it public and why.
- Personal side projects and private use are outside the Act, but the line moves the moment processing becomes organisational.
- Confirm scope early, it decides whether the rest of your readiness work is even required.
The Section 3 scope test
Implementation aidThis works through Section 3 clause by clause for a single processing activity. It is a navigation aid, not statutory text, and it does not replace legal advice on borderline facts.
Offline data that becomes digital: Section 3(a)(ii)
StatutorySection 3(a)(ii) applies the Act to personal data collected in non-digital form and digitised subsequently. The moment a paper or offline record is converted into digital form, that digital copy is within scope.
InterpretationThis does not mean every physical record your organisation holds is governed by the Act. Paper that is never digitised falls outside the Act's digital-data scope. What Section 3(a)(ii) catches is the digitised copy, so the practical trigger is the act of digitisation, not the mere existence of the paper original.
Section 3 vs Section 17: scope is not the same as exemption
StatutoryThese two provisions are frequently confused, and some secondary sources wrongly list Section 17 grounds (such as enforcing a legal claim) as Section 3 exclusions. They are different mechanisms with different legal effects.
| Section 3 | Section 17 | |
|---|---|---|
| Question answered | Is this processing within the Act's scope at all? | Given the Act applies, are specific obligations switched off for this processing? |
| Mechanism | Scope and exclusion. If excluded, the Act does not apply to that processing. | Exemption. The Act still applies, but listed provisions are disapplied in defined situations. |
| Legal effect | Under Section 3(c), the obligations never attach in the first place. | Under Section 17(1), the provisions of Chapter II (except sub-sections (1) and (5) of Section 8), Chapter III, and Section 16 do not apply in the specified cases. |
| Examples | Personal or domestic use; data the Data Principal made public. | Processing to enforce a legal right or claim; certain notified State processing; research, archival or statistical purposes, subject to prescribed standards. |
| Go deeper | Section 3 (this page) | Section 17 |
Section 17 has specific enumerated grounds and conditions. Confirm the exact categories on the Section 17 page before relying on any exemption.
Worked scenarios: does the Act apply?
Good practiceCautious, non-definitive analysis. Facts change outcomes; treat these as starting points, not conclusions.
| Scenario | Relevant clause | Likely analysis | Why | Also check |
|---|---|---|---|---|
| Indian NBFC digitising paper KYC | 3(a)(ii) | In scope | Paper becomes digital personal data once keyed into the system | S4, S5, S6, S8 |
| Overseas SaaS serving Indian users | 3(b) | Processing abroad connected with offering services to Data Principals in India | S16, S8 | |
| Indian ecommerce serving Indian users | 3(a) | In scope | Digital personal data processed within India | S5, S6, S8 |
| Individual's private contact list | 3(c)(i) | Out of scope | Purely personal or domestic use by an individual | Flips to in scope if used commercially |
| Company reusing public social-profile data | 3(c)(ii) | Carve-out applies only where the person made it public, or a legal duty required publication; third-party scraping generally is not carved out | S4, S8; consider any S17 ground | |
| Foreign firm, only foreign clients, no India offering | 3(b) not triggered | Likely out of scope | No offering of goods or services to Data Principals in India | Re-check if any India-facing activity exists |
| Employer processing Indian employees' digital HR data | 3(a) | In scope | Organisational processing of digital personal data in India, not personal or domestic | S4, S7 (employment uses), S8 |
Where to go next
Follow the analysis into the provisions that decide what applies once you are in scope:
- Section 2: Definitions – the defined terms that drive how Section 3 reads for you.
- Section 4: Grounds for processing – the first obligation once you are in scope.
- Section 16: Processing outside India – where cross-border processing is treated.
- Section 17: Exemptions – when otherwise-applicable obligations are switched off.
- Chapter I hub – how Sections 1 to 3 fit together, and commencement status.
- Personal data, Data Principal and Data Fiduciary in the glossary.
- Readiness assessment – turn this scope analysis into a checklist.
Frequently asked questions
Does the DPDP Act apply to companies outside India?
Is publicly available data exempt?
Does the Act cover my personal contacts?
What about paper records held in India?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.