Section 3: Application of Act
Section 3 draws the outer boundary of the entire Act: what kind of data it covers, whose processing it reaches even outside India, and three specific situations it carves out entirely — personal or domestic use, and data the individual (or someone legally required to) has already made public.
Quick summary
What Section 3 says
- Clause (a) — the Act applies to processing digital personal data within India where the personal data is collected (i) in digital form, or (ii) in non-digital form and digitised afterwards.
- Clause (b) — it also applies to processing digital personal data outside India, if that processing is in connection with any activity of offering goods or services to Data Principals within India.
- Clause (c) — it does not apply to (i) personal data processed by an individual for a personal or domestic purpose, or (ii) personal data that has been made or caused to be made publicly available, either (A) by the Data Principal it relates to, or (B) by any other person under a legal obligation to make that data publicly available.
Breaking it down
Three separate applicability tests, not one. Clause (c) carves out whatever (a) and (b) would otherwise catch.
Baseline: inside India
Digital personal data collected in India, whether it started life digital or was digitised later (think of a paper KYC form later scanned and stored).
Reaches outside India
A company with no office in India can still be caught if it's selling to or serving people located in India.
Carved back out
Two categories fall outside the Act regardless of where the processing happens: personal or domestic use, and data already made public in the specified ways.
The “personal or domestic purpose” carve-out. This exists so ordinary, non-commercial activity — keeping a personal phone contacts list, emailing family photos — isn't swept into a compliance regime built for organisations. It does not extend to a business processing customer data, even a very small one.
The “publicly available data” carve-out, and its limit. If a Data Principal has voluntarily published their own data (a public social media profile, for instance), the Act's own official illustration confirms the Act doesn't apply to that data. The same applies to data someone else was legally required to publish (like certain regulatory disclosures). This is narrower than it sounds: it covers data made public by the Data Principal or by legal obligation — not data a company itself chooses to publish, or data that's merely easy to find.
Why this section matters
Before asking what the Act requires you to do, it's worth checking whether the Act reaches your processing at all. Section 3 is where that question gets answered. Two mistakes are common: assuming the Act only applies to Indian companies (clause (b) says otherwise for anyone serving Indian users), and assuming any data someone can find online is automatically exempt (clause (c) is much narrower than that — it turns on who published it and why, not on how easy it is to find).
Real-world example
LoopHealth, a US-based telehealth platform with Indian patients
LoopHealth has no office or entity registered in India, but a growing share of patients book consultations from Indian cities.
- Does the Act apply to LoopHealth? — Yes — under clause (b), offering telehealth services to Data Principals within India brings LoopHealth's processing within scope, even though its servers and staff are entirely outside India.
- What about a doctor's personal WhatsApp used to message a family member about a checkup? — That falls under the clause (c)(i) personal/domestic exemption — it isn't LoopHealth's organisational processing.
- A patient's public LinkedIn post mentioning their own diagnosis? — Under clause (c)(ii)(A), data the Data Principal has chosen to make public themselves falls outside the Act — but LoopHealth still can't treat its own patient records as “public” just because a patient once posted about their condition elsewhere.
Who needs to care about this section
- Foreign companies serving Indian customers — clause (b)'s extraterritorial reach means “we're not based in India” is not, on its own, a reason the Act doesn't apply.
- Anyone handling digitised paper records — clause (a)(ii) confirms that scanning or digitising previously offline records brings that data within the Act's scope.
- Legal and privacy teams evaluating a “public data” defence — clause (c)(ii) is a narrow exemption tied to who published the data, not a general licence to use anything discoverable online.
Common questions
If our servers are outside India, does the Act still apply?
Does scraping public social media profiles fall outside the Act?
Does the Act cover data about companies, or only individuals?
Related sections
Section 4 — Grounds for Processing Personal Data
Continue to the next section in sequence.
Read Section 4Section 2 — Definitions
Go back to the previous section.
Read Section 2Chapter I — Preliminary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsWho the Act applies to
The broader plain-language overview of applicability, alongside the Act's other core concepts.
See the overview