Section 3: Application of Act

Section 3 sets out when the Digital Personal Data Protection Act applies. It covers the processing of digital personal data within India. This includes personal data that is collected in a digital format right from the start, as well as data collected in a non-digital form and later digitized. (A Data Principal is the individual to whom the personal data relates). The Act also reaches beyond India's borders. It applies to the processing of digital personal data outside of India if that processing is connected to offering goods or services to Data Principals located within India. Finally, the Act specifically excludes certain types of data processing. It does not apply when an individual processes personal data purely for personal or domestic purposes. It also does not apply to personal data that has been made publicly available by the Data Principal themselves. For example, if an individual publicly shares their own personal data on a social media blog, the Act does not apply to that data. The Act also does not apply if a person is required by an Indian law to make the personal data publicly available.

Key points

• The Act applies to processing digital personal data in India, whether collected digitally or digitized later [(a)].
• It applies to processing outside India if connected to offering goods or services to Data Principals in India [(b)].
• The Act does not apply to personal data processed by an individual for personal or domestic purposes [(c)(i)].
• The Act does not apply to personal data made publicly available by the Data Principal themselves [(c)(ii)(A)].
• The Act does not apply to personal data made publicly available by someone legally obligated under Indian law to do so [(c)(ii)(B)].

Common misreadings

• One might assume the Act applies to all paper records, but it only applies to non-digital data if it is subsequently digitized.
• One might think the Act protects data that a Data Principal voluntarily publishes on a public blog, but the Act explicitly excludes data made publicly available by the Data Principal.