DPDP Act 2023 · s. 3 · Ch. IUpcoming · 13 May 2027

Application of Act

Status: Upcoming
Applies from: 13 May 2027G.S.R. 843(E)
Penalty: No separate penalty
Binds: No direct duty on companies

In plain English

The Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India. It leaves out data processed for personal or domestic purposes and data a Data Principal has made public themselves or that is public under a legal duty.

Gazette text · s. 3Subject to the provisions of this Act, it shall—

Subject to the provisions of this Act, it shall—
1. (a)
  apply to the processing of digital personal data within the territory of India where the personal data is collected––
  1. (i)
    in digital form; or
  2. (ii)
    in non-digital form and digitised subsequently;
2. (b)
  also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;
3. (c)
  not apply to—
  1. (i)
    personal data processed by an individual for any personal or domestic purpose; and
  2. (ii)
    personal data that is made or caused to be made publicly available by—
  3. (A) the Data Principal to whom such personal data relates; or
  4. (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
  5. Illustration. X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)

Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 3 · Change log