Section 3 — Application of Act

What this section requires

Section 3 fixes the Act's scope along two axes: where the data was collected, and where the processing happens.

It applies to processing digital personal data within India, whether the data was born digital or started on paper and was digitised afterward. It also reaches processing outside India, but only where that processing connects to offering goods or services to people in India.

It carves out two things entirely: personal data an individual processes for a purely personal or domestic purpose, and personal data someone has made publicly available themselves (or that another person was legally obliged to publish).

Who it applies to

Any organisation processing digital personal data inside India, and any organisation outside India whose processing relates to offering goods or services to people here — the same "who it binds" test the rest of this guide assumes throughout.

Checklist

• Confirm whether any personal data you process was collected in digital form, or non-digital form and digitised afterward — either counts.
• If you operate from outside India, check whether your processing connects to offering goods or services to people in India; if so, the Act reaches you regardless of where your servers or entity sit.
• Do not rely on the personal/domestic-purpose carve-out for anything done in a business or organisational capacity — it covers an individual acting purely for herself.
• Do not assume the public-data carve-out covers data you yourself made public on someone else's behalf; it applies to what the Data Principal (or someone legally required to) published, not to what a Data Fiduciary chooses to publish.

Penalty exposure

Not applicable — Section 3 sets scope, not an obligation, so no Schedule penalty attaches to it directly. Getting the scope determination wrong exposes you to whichever substantive section actually applies once you're within it.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).