Section 3 — Application of the Act

Sections 4 onward describe what a Data Fiduciary must do. Section 3 answers a prior question: is this the Act's business at all. It sets that boundary along two axes — geography, and the form the data takes — and then carves two specific categories back out. Get the boundary wrong and every downstream obligation is either applied where it shouldn't be, or skipped where it should apply.

Inside India — 3(a)

The Act applies to processing of digital personal data within the territory of India, where the personal data was collected either in digital form, or in non-digital form and digitised afterwards. There's no citizenship or residency test here — an Indian hotel chain processing a foreign tourist's booking data is squarely inside this clause, because the processing happens on Indian territory. The nationality of the Data Principal simply doesn't feature in 3(a) at all.

Outside India, but aimed at India — 3(b)

The Act reaches beyond India's borders too: processing of digital personal data outside India is covered if that processing is connected to offering goods or services to Data Principals within India. A company with no Indian office, no Indian servers and no Indian staff can still fall inside 3(b) purely because it's selling to Indian customers online — location of the processing doesn't shield you if the activity the processing supports is aimed at India.

Digital in, digitised-later in — the material test

Both clauses key off "digital personal data," which Section 2(n) defines as personal data in digital form. Read together with 3(a)(ii), that reach extends to personal data collected on paper and later digitised — a physical form later scanned or keyed into a system falls within scope from the point it becomes digital. What stays outside is personal data that is collected and remains purely on paper, never digitised — the Act's own text draws the line there, though sector-specific rules can still apply to that untouched paper record independently of the DPDPA.

Two things the Act deliberately doesn't touch — 3(c)

Clause (c) carves out two categories entirely. First, personal data processed by an individual for a personal or domestic purpose — the Act isn't regulating how you keep your own phone's contact list. Second, personal data that's been made or caused to be made publicly available, either by the Data Principal herself, or by someone under a legal obligation to make it public. The Act's own illustration is direct: an individual who publicly posts her own personal data on social media while blogging takes that data outside the Act's reach for that specific processing.

Both carve-outs are narrower than they sound. The personal-or-domestic exemption doesn't extend to a business processing the same category of data for a commercial purpose, even at small scale. And the publicly-available exemption applies only to data the Data Principal (or a legally-obligated discloser) chose to make public — data someone else leaked, scraped, or exposed without that choice doesn't fall under this carve-out just because it's now technically visible online.

Why this matters in practice

Section 3 is where "does the DPDPA even apply to us" questions actually get answered, and the answer is rarely a clean yes or no across an entire organisation — it's usually yes for some data flows and no for others, decided flow by flow. A company might be squarely inside 3(a) for its Indian customer database, entirely outside via the personal-purpose carve-out for an employee's private contacts app, and inside 3(b) for an overseas subsidiary's website that still takes orders from Indian shoppers — all three conclusions sitting inside one corporate group.

Illustration: a SaaS company headquartered in Singapore, with no Indian entity, runs a website that Indian customers use to sign up and pay for a subscription. The processing happens entirely on servers outside India. Because that processing is connected to offering a service to Data Principals within India, Section 3(b) brings it inside the Act regardless of where the company or its infrastructure sits.

How Section 3 connects to the rest of the Act

Section 3 uses the "personal data" and "digital personal data" definitions Section 2 sets up, and once a data flow clears this threshold, Section 4 takes over to ask whether there's a lawful basis — consent under Section 6, or a legitimate use under Section 7 — for processing it. Section 17 layers a separate set of exemptions on top of this for specific government functions and other listed situations, but those apply to data already inside Section 3's boundary, not as an alternative way of falling outside it.