Section 3

Application of the Act

Sets the territorial and material reach: digital personal data processed in India, and offshore processing tied to offering goods or services into India.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(a): It applies to processing of digital personal data within India, whether the data was collected in digital form or collected on paper and digitised afterwards.
(b): It also applies to processing outside India where that processing is connected to any activity relating to offering goods or services to Data Principals in India.
(c): It does not apply to personal data processed by an individual for a personal or domestic purpose, or to personal data the Data Principal has made publicly available herself, or that another person was legally obliged to make public.

In practice

Clause (b) is the one that reaches foreign companies. A business with no Indian entity, no Indian server and no Indian employee is still inside the Act if it sells to people in India. Clause (a) also closes the paper loophole: scanning a signed form brings it in.

s.2DefinitionsDefines the terms the whole Act turns on, including who counts as a child, a Data Fiduciary and a Data Processor.s.16Processing of personal data outside IndiaLets the Central Government restrict transfers of personal data to notified countries, and preserves stricter transfer rules found in other laws.s.17ExemptionsLists where most of the Act is switched off, including legal claims, regulatory functions, offshore contracts and research.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 3 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next