Section 3 of Digital Personal Data Protection Act, 2023 - Application of Act

Section 3 defines the scope of the Digital Personal Data Protection Act, 2023 (DPDP Act). It identifies the digital personal data processing to which the Act applies in India, when it can apply to processing outside India, and the categories of processing excluded from its scope.

Commencement status: The Central Government notification dated 13 November 2025 provides that Section 3 will come into force eighteen months from publication of that notification. Accordingly, as on 24 September 2026, Section 3 has not yet reached its notified commencement date.

What Section 3 covers

Section 3 is the principal scope provision of the DPDP Act. Its operation can be understood through three questions: whether the data is digital personal data, where the relevant processing takes place, and whether an express exclusion applies.

Section 3 - Application of Act

Subject to the provisions of the Act, Section 3 provides that the Act:

applies to processing of digital personal data within India where the personal data is collected in digital form, or is collected in non-digital form and digitised subsequently;
also applies to processing of digital personal data outside India when the processing is connected with an activity related to offering goods or services to Data Principals within India; and
does not apply to personal data processed by an individual for a personal or domestic purpose, or to personal data made publicly available by the Data Principal or by another person who is legally required to make it publicly available.

Meaning of important terms

Personal data: Under Section 2, personal data means any data about an individual who is identifiable by or in relation to such data.

Digital personal data: Personal data in digital form.

Processing: A wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, storage, use, sharing, disclosure, restriction, erasure or destruction.

Data Principal: The individual to whom the personal data relates. The statutory definition also contains specific rules for children and persons with disability having a lawful guardian.

Application within India

The Act is designed to apply where personal data is processed digitally within India and the data was either collected digitally from the beginning or was initially collected in a non-digital form and later digitised.

Example: Information submitted through an online registration form is collected in digital form. Subject to the other provisions of the Act, processing of that personal data within India falls within Section 3.

Example: A paper application containing personal information is later scanned or entered into a computer system. Once the non-digital personal data is digitised and processed digitally, Section 3 may apply.

Extra-territorial application

Section 3 is not confined to processing physically carried out within India. Processing outside India is also brought within its scope when that processing is connected with an activity related to offering goods or services to Data Principals within India.

This provision is important for overseas businesses and digital services that process personal data outside India while offering goods or services to individuals within India.

Personal or domestic purpose exclusion

The Act does not apply where an individual processes personal data for a personal or domestic purpose. This exclusion distinguishes ordinary private activity from processing that falls within the regulatory framework of the Act.

Publicly available personal data exclusion

Section 3 also excludes specified publicly available personal data. The exclusion covers personal data made publicly available by the Data Principal herself or himself, and personal data made publicly available by another person who is under a legal obligation in India to make that data public.

Important: The statutory exclusion is framed by reference to how the personal data was made publicly available. The mere fact that information can be found somewhere on the internet should not automatically be treated as establishing that the Section 3 exclusion applies.

Statutory illustration

The Act illustrates the publicly available data exclusion by referring to an individual who, while blogging her views, makes her personal data publicly available on social media. In that stated situation, the Act does not apply to that publicly available personal data.

Practical scope of Section 3

For practical analysis, first determine whether the information is personal data relating to an identifiable individual. Next determine whether the relevant operation amounts to processing of digital personal data. The location and circumstances of processing must then be examined, followed by the specific exclusions contained in Section 3 and any other applicable provisions or exemptions under the Act.

Current legal position and DPDP Rules, 2025

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with phased commencement. The commencement notification for the Act likewise uses a phased structure. Section 3 is among the provisions scheduled to commence eighteen months after publication of the 13 November 2025 notification.

Users should therefore distinguish between the enacted text of Section 3 and its notified commencement date when assessing present legal obligations.

Official legal resources

For the authoritative text and current notifications, refer to the official India Code and Ministry of Electronics and Information Technology resources listed in the sidebar.

Last reviewed: 24 September 2026. This page is a general legal information resource and should be read with the Act, commencement notifications, applicable rules and subsequent amendments or official notifications.