How to Determine the Application of the DPDP Act Under Section 3
Most questions about the Digital Personal Data Protection Act, 2023 are asked in the wrong order. Before anything turns on consent, notice or a legitimate use, there is a prior question, and section 3 is the only provision that answers it. The application of the DPDP Act is defined by subject matter and by territory at once, and the section does the work in three short clauses.
Step 1: Fix the Commencement Position
Section 3 belongs to the group that comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. So do the obligations in Chapter II and the rights in Chapter III that the section would switch on.
Nothing in the section is operative today, which makes the scoping exercise cheap to do now and expensive to do late. An organisation that has already decided which of its processing falls inside clause (a), which falls inside clause (b) and which is excluded by clause (c) is left with a mapping task rather than a legal question.
Step 2: Read Clause (a) for Processing Within India
Clause (a) applies the Act to the processing of digital personal data within the territory of India. It covers personal data collected in digital form and personal data collected in non-digital form and digitised afterwards.
The second limb is the one that gets missed. A paper form, a signed register or a handwritten note is outside the Act while it stays on paper, and within it once the contents are scanned or keyed in. So the moment of digitisation, and not the moment of collection, is what brings an old record within the Act.
Step 3: Read Clause (b) for Processing Outside India
Clause (b) applies the Act to the processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to the offering of goods or services to Data Principals within the territory of India.
Two features of that wording control its reach. The connecting factor is the offering of goods or services to persons in India, not the nationality of the Data Principal and not the location of the servers. And the link is expressed as any activity related to that offering, which is wider than the act of offering itself.
Step 4: Do Not Confuse Clause (b) With the Transfer Restriction
Clause (b) answers whether the Act reaches processing that happens abroad. It is not the provision that controls sending personal data out of India. That is section 16, which empowers the Central Government by notification to restrict the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India, and rule 15 of the DPDP Rules 2025.
The two provisions can apply to the same arrangement for different reasons, and an advice that runs them together will answer neither question. Section 16 also commences eighteen months after publication, and its second sub-section preserves any law in force in India that gives a higher degree of protection or a stricter restriction on such a transfer.
Step 5: Apply the Personal or Domestic Purpose Exclusion Precisely
Clause (c)(i) provides that the Act does not apply to personal data processed by an individual for any personal or domestic purpose. Each element of that is load bearing: the processor must be an individual, and the purpose must be personal or domestic.
So the exclusion does not reach a sole proprietor processing customer data for a trade, and it does not reach an individual processing on behalf of an organisation. Where the exclusion is asserted, the question to put is what the purpose of the processing was, and the answer belongs on the file rather than in the submission.
Step 6: Apply the Publicly Available Exclusion as It Is Drafted
Clause (c)(ii) excludes personal data that is made or caused to be made publicly available by the Data Principal to whom such personal data relates, or by any other person who is under an obligation under any law in force in India to make such personal data publicly available.
The exclusion turns on who made the data public and under what compulsion, not on the fact that the data is now accessible. Personal data that became public through a breach, a leak or a third party's choice is not within either limb, because neither the Data Principal made it public nor was anyone obliged by Indian law to do so. The illustration printed under the section is of an individual who voluntarily makes her own personal data public, which is squarely the first limb.
Step 7: Record the Scoping Conclusion and the Facts It Rests On
Each conclusion under section 3 rests on facts that change: where processing happens, whether a record has been digitised, whether goods or services are offered to persons in India, and who put particular personal data into the public domain. Record the conclusion, the clause relied on and the facts, with dates.
That record is what makes the position defensible and what makes it reviewable. A scoping note that states a conclusion without the facts behind it cannot be tested when one of those facts moves, and in practice at least one of them will.
Common Pitfalls to Avoid
Starting with consent: Section 3 is the prior question, and it is answered by subject matter and territory.
Forgetting digitised records: Clause (a) covers personal data collected in non-digital form and digitised afterwards.
Treating clause (b) as a nationality test: The connecting factor is the offering of goods or services to Data Principals within the territory of India.
Reading clause (b) narrowly: It reaches processing in connection with any activity related to that offering.
Confusing application with transfer: Section 16 is the restriction on transfer for processing to a notified country or territory.
Stretching the domestic exclusion: It applies to an individual processing for a personal or domestic purpose.
Treating anything accessible as publicly available: The exclusion turns on the Data Principal making it public or a legal obligation under Indian law to do so.
Leaving the scoping facts unrecorded: Every conclusion under the section rests on facts that can change.
Key Statutory Provisions
Section 3 of the Digital Personal Data Protection Act, 2023: Application of Act. Clause (a) applies the Act to the processing of digital personal data within the territory of India, whether collected in digital form or collected in non-digital form and digitised afterwards. Clause (b) applies it to processing outside India in connection with any activity related to the offering of goods or services to Data Principals within India. Clause (c) excludes personal data processed by an individual for a personal or domestic purpose, and personal data made publicly available by the Data Principal or by a person obliged under Indian law to make it public.
Section 16 of the Act: Processing of personal data outside India. The Central Government may by notification restrict the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India, and the section does not restrict the applicability of any law in force in India giving a higher degree of protection or a stricter restriction on such transfer.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Places section 3 and section 16 in the group commencing eighteen months after publication, together with the obligations in Chapter II and the rights in Chapter III. The short title and commencement provision and the definitions provision, which are the other two provisions of Chapter I, came into force on publication.
Related in This Series
How to Rely on the Research and Statistical Exemption Under Rule 16 of the DPDP Rules 2025: where the Act stops applying even though it covers the data.
How to Draft a DPDP Notice That Meets Rule 3 of the DPDP Rules 2025: the first obligation that bites once the Act applies.
How to Read the Power to Amend the Schedule Under Section 42 of the DPDP Act: how the penalties behind the Act can change without Parliament.
Removal of Difficulties Order Corrects the DPDP Act on Children's Consent and Significant Data Fiduciary Audits: the first executive correction to the text of the Act.
Sources and References
Section 3 of the Digital Personal Data Protection Act, 2023, bare text
Section 16, processing of personal data outside India, bare text
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapters I and IV
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments