Section 3 — DPDP Act, 2023
(1) The provisions of this Act shall apply to the processing of digital personal data within the territory of India where such personal data is collected— (a) in digital form; or (b) in non-digital form and digitised subsequently. (2) The provisions of this Act shall also apply to the processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India. (3) The provisions of this Act shall not apply to— (a) personal data processed by an individual for any personal or domestic purpose; and (b) personal data that is made or caused to be made publicly available by the Data Principal to whom such personal data relates, or by any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 3 answers the threshold question every compliance team must resolve first: does the DPDP Act even reach this processing activity? The territorial scope is broader than many organisations assume — it covers processing outside India when the activity relates to offering goods or services to people in India. The two key exclusions are genuinely narrow: personal/domestic use (not commercial), and data the Data Principal themselves made publicly available.
A US-based HR software company with Indian corporate customers processes employee personal data of Indian nationals. Even though the servers are in Virginia and the company has no India entity, Section 3(2) applies because the service is offered to persons in India. The full Chapter II obligation stack applies.
Data that a Data Principal made publicly available (e.g., a public LinkedIn profile) is excluded from the Act only for the purpose and in the context in which it was made public. Aggregating public data across sources, or using it for purposes the Data Principal did not contemplate, is not covered by the exclusion.
An individual keeping a personal diary with friends' contact details: excluded. A freelancer keeping a client database: not excluded — there is a commercial purpose and the processing is not domestic in nature.