Data protection · Provision
Digital personal data processed in India, and processing abroad that serves people in India. Paper that is never digitised, personal use, and data the person made public are outside it. (Section 3, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Under Section 3 of the DPDP Act 2023, the Act applies to the processing of digital personal data in India, whether it was collected digitally or collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India. It does not apply to personal data an individual processes for personal or domestic purposes, or to personal data made publicly available by the person it relates to or by someone legally required to publish it. There is no size test: a five-person firm is covered.
3. Application of Act.— Subject to the provisions of this Act, it shall— (a) apply to the processing of digital personal data within the territory of India where the personal data is collected— (i) in digital form; or (ii) in non-digital form and digitised subsequently; (b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India; (c) not apply to— (i) personal data processed by an individual for any personal or domestic purpose; and (ii) personal data that is made or caused to be made publicly available by— (A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available. Illustration. X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.
| Situation | Covered by the Act? | Provision |
|---|---|---|
| Customer data in a CRM, app or spreadsheet in India | Yes | s.3(a)(i) |
| Paper forms later scanned or typed into a system | Yes | s.3(a)(ii) |
| Paper records never digitised | No | s.3(a) |
| A business abroad selling online to people in India | Yes | s.3(b) |
| Employee records of a business in India | Yes, though employment processing needs no consent (s.7(i)) | s.3(a) |
| An individual's own contacts and photos, kept for personal use | No | s.3(c)(i) |
| Data the person made public themselves, such as a public post | No | s.3(c)(ii)(A) |
| Data a law requires someone to publish | No | s.3(c)(ii)(B) |
No threshold. Section 3 sets no turnover or headcount test. Start-ups can be relieved of some duties only by a notification under section 17(3).
Yes. Section 3 applies the Act to any processing of digital personal data in India, with no turnover or headcount threshold. The Central Government may relieve notified start-ups of some duties under section 17(3), but only by notification.
Only once they are digitised. Section 3(a) covers personal data collected in digital form, or collected in non-digital form and digitised subsequently. Records that stay on paper are outside the Act.
Yes, where their processing is in connection with any activity related to offering goods or services to Data Principals in India, under section 3(b).
Only data made publicly available by the Data Principal herself, or by someone under a legal obligation to publish it, under section 3(c)(ii). Data that is merely accessible online, or was leaked, is not excluded on that ground.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 3 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.