DPDP reference
Section 3: Application of the Act
Last checked 6 Nov 2026
The Act covers digital personal data processed in India, whether it was collected in digital form or collected on paper and digitised later (s.3(a)). It also reaches processing outside India when that processing is connected with offering goods or services to people in India (s.3(b)).
It does not cover personal data an individual processes for a personal or domestic purpose (s.3(c)(i)). It also does not cover personal data made publicly available by the individual it relates to, or by a person obliged by Indian law to publish it (s.3(c)(ii)).
- Applies to
- Any person processing digital personal data in India, and any person abroad offering goods or services to people in India.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- None of its own. This section sets out how the law works and places no duty on a business.
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 3; G.S.R. 843(E), commencement
Questions
Does the DPDP Act apply to paper records?
Paper records alone are outside it. Personal data collected on paper and digitised later is inside it (s.3(a)(ii)).
Does the DPDP Act apply to a business outside India?
Yes, where its processing is connected with offering goods or services to Data Principals in India (s.3(b)).
Related
Next
Not legal advice.