Section 3

Section 3 is the precise scope-drawing provision of the DPDP Act — it defines exactly when the Act applies and when it does not. Section 3(1) establishes territorial scope: the Act applies to digital personal data processed within India, whether collected digitally or originally on paper and subsequently digitised. This covers a vast range of scenarios: digital-native businesses that collect data through apps and websites; traditional businesses that scan paper forms into digital systems; hospitals that convert paper patient records into electronic databases; and government departments that digitise citizen records. Section 3(2) is the extra-territorial arm: the Act also applies to processing outside India if it is connected to offering goods or services to Indian Data Principals — the GDPR targeting principle. A US company running an app for Indian users, a European cloud service processing Indian employees' data, or a Singapore-based data broker profiling Indian consumers are all caught. Section 3(3) carves out two categories. The personal/domestic exclusion (3(3)(a)) ensures individuals who process data for entirely personal purposes — a home video archive, a personal address book, a home security camera — are not regulated as Data Fiduciaries. The publicly available data exclusion (3(3)(b)) is more nuanced: if the Data Principal themselves has made data public (a Twitter post, a public LinkedIn profile, an announcement) or if another person is required by law to publish it (a company's directors' names in the MCA registry, a court judgment with named parties), that data is excluded from the Act's requirements. This exclusion has significant implications: platforms that scrape publicly available social media data for training AI models or market research will argue they fall within 3(3)(b). However, the exclusion applies only to the specifically published data — further processing of that data beyond its public scope remains subject to the Act.