---
title: "DPDP Act Section 3: Application of Act | dpdpr.in"
description: "Section 3 of the DPDP Act 2023, Application of Act: the official text, what it means in plain English and Hindi, and who it affects."
url: "https://dpdpr.in/act/section-3/"
canonical: "https://dpdpr.in/act/section-3/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Section 3. Application of Act

DPDP Act, 2023 · Chapter I: Preliminary

## In simple words

The Act covers personal data in digital form in India. It also covers paper data that is later digitised. It covers processing outside India if it is linked to offering goods or services to people in India. It does not cover data used by a person for personal or household purposes, or data a person has made public herself.

- **What this means for you**: Your data is protected when a company or the Government handles it digitally. Things you post publicly yourself are not covered.

- **What this means for businesses**: Foreign companies that sell to people in India are covered too. Paper records become covered once you digitise them.

- **Everyday example**: A shopping website based abroad that sells to customers in India must follow the Act for those customers' data.

सरल शब्दों में (हिन्दी अनुवाद)

यह कानून भारत में डिजिटल रूप में मौजूद व्यक्तिगत डेटा पर लागू होता है। यह उस कागज़ी डेटा पर भी लागू होता है जिसे बाद में डिजिटल बनाया जाता है। भारत के बाहर होने वाली प्रोसेसिंग पर भी यह लागू होता है, अगर वह भारत में लोगों को सामान या सेवाएँ देने से जुड़ी हो। यह उस डेटा पर लागू नहीं होता जिसे कोई व्यक्ति अपने निजी या घरेलू काम के लिए इस्तेमाल करता है, या जिसे व्यक्ति ने खुद सार्वजनिक किया हो।

- **आपके लिए इसका मतलब**: जब कोई कंपनी या सरकार आपका डेटा डिजिटल रूप में संभालती है, तो वह सुरक्षित रहता है। जो चीज़ें आप खुद सार्वजनिक रूप से पोस्ट करते हैं, वे इसमें शामिल नहीं हैं।

- **कारोबार के लिए इसका मतलब**: भारत में लोगों को सामान बेचने वाली विदेशी कंपनियाँ भी इसके दायरे में हैं। कागज़ी रिकॉर्ड डिजिटल बनाते ही इसके दायरे में आ जाते हैं।

- **रोज़मर्रा का उदाहरण**: विदेश में स्थित कोई शॉपिंग वेबसाइट, जो भारत के ग्राहकों को सामान बेचती है, उन ग्राहकों के डेटा के लिए इस कानून का पालन करेगी।

This is our Hindi translation of the plain English summary above, not the official Hindi text of the Act. If they differ, the official text prevails.

## Who it applies to

Anyone processing digital personal data in India, and anyone abroad processing it in connection with offering goods or services to people in India.

## Related Rules

No specific rule. The text of the Act applies on its own.

### Related sections

- [Section 2. Definitions](https://dpdpr.in/act/section-2/)
- [Section 4. Grounds for processing personal data](https://dpdpr.in/act/section-4/)
- [Section 17. Exemptions](https://dpdpr.in/act/section-17/)

Official text as notified

Source: [MeitY copy of the Gazette (CG-DL-E-12082023-248045), page 3](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf#page=3). Printed dashes are shown as colons; the wording is unchanged.

Subject to the provisions of this Act, it shall:

(a) apply to the processing of digital personal data within the territory of India where the personal data is collected:

(i) in digital form; or

(ii) in non-digital form and digitised subsequently;

(b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;

(c) not apply to:

(i) personal data processed by an individual for any personal or domestic purpose; and

(ii) personal data that is made or caused to be made publicly available by:

(A) the Data Principal to whom such personal data relates; or

(B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

Illustration.

X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

## When this takes effect

- Whole section **Starts 13 May 2027** 191 days to go

Source: [G.S.R. 843(E)](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf) and [rule 1](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). [All deadlines](https://dpdpr.in/deadlines/)