Home > Chapter I: Preliminary - Sections 1-3 > India DPDPA: Article 3 – Application of the Act

India DPDPA: Article 3 – Application of the Act

Published by the Secure Privacy Compliance Team · Last reviewed: Feb 2026

3. Application of the Act

Subject to the provisions of this Act, it shall— (a) apply to the processing of digital personal data within the territory of India where the personal data is collected––

(i) in digital form; or

(ii) in non-digital form and digitised subsequently;

(b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering ofgoods or services to Data Principals within the territory of India;

(c) not apply to—

(i) personal data processed by an individual for any personal or domestic purpose; and

(ii) personal data that is made or caused to be made publicly available

by—

(A) the Data Principal to whom such personal data relates; or

(B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

What Article 3 Means for Your Business

Article 3 defines the territorial scope of the DPDPA. It applies to digital personal data processed within India, and, critically, to data processed outside India if the processing is connected to offering goods or services to individuals in India. This extraterritorial reach means that foreign businesses serving Indian customers are caught by the Act even if they have no physical presence in India.

  • If your business collects data from Indian users, whether through a website, app, or service, you are likely within scope regardless of where your servers or headquarters are located.
  • The Act does not apply to personal data processed by individuals for personal or domestic purposes.
  • There is a specific exemption for Indian companies that process personal data collected outside India under an outsourcing contract, this is designed to protect India’s IT/BPO sector.
  • Foreign companies must appoint a representative or Data Protection Officer and establish compliance mechanisms even without a local office in India.
  • Conduct a territorial scope assessment to confirm whether your organisation’s activities fall within the Act before determining which obligations apply.

Frequently Asked Questions about Article 3

+ When does the DPDP Act apply to a business?
The Act applies when digital personal data is processed within India or when businesses outside India process data related to offering goods or services to individuals in India.
+ Does the DPDP Act apply to foreign companies?
Yes. Foreign companies must comply if they process personal data in connection with offering goods or services to individuals located in India.
+ Does the Act apply to non-digital data?
It applies to non-digital personal data only if it is digitized later. Purely offline data that is never digitized is not covered.
+ Are there any exemptions under this article?
Yes. The Act does not apply to personal data processed for personal or domestic purposes, or data that is made publicly available by the individual or under legal obligation.
+ Why is Article 3 important for compliance?
It helps businesses determine whether they fall under the scope of the DPDP Act, which is the first step in understanding and implementing compliance requirements.

Related Articles

Scroll to Top