Chapter 1 · Preliminary
Section 3 - Application of Act
Where the Act applies - within India and beyondThis section draws the boundary of the law - where it applies and where it does not.
Download full Act (PDF)In plain English
This section draws the boundary of the law - where it applies and where it does not. It covers digital personal data processed in India, including data first collected on paper and later digitised. Crucially, it reaches beyond India's borders: a business outside India is still bound if it processes personal data in connection with offering goods or services to people in India. It does not apply to purely personal or domestic use, or to personal data an individual has themselves made public.
A US-based app with no Indian office is still bound by the Act the moment it signs up and serves users in India.
Key points
- Applies to digital personal data processed within India - including paper data later digitised.
- Extra-territorial: reaches foreign businesses offering goods or services to people in India.
- Does not apply to personal or domestic processing by an individual.
- Does not apply to personal data made publicly available by the individual (or by someone legally required to publish it).
Official section text
Section 3. Application of Act.
Subject to the provisions of this Act, it shall -
apply to the processing of digital personal data within the territory of India where the personal data is collected--
in digital form; or
in non-digital form and digitised subsequently;
also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;
not apply to -
personal data processed by an individual for any personal or domestic purpose; and
personal data that is made or caused to be made publicly available by -
the Data Principal to whom such personal data relates; or
any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.