Section 3 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 3 sets the territorial and format scope of the Act. Clause (a) covers digital personal data processed within India, including paper data that is digitised later. Clause (b) reaches processing outside India when it is linked to offering goods or services to people in India. The exclusions in clause (c) are covered in the next article. If you are unsure whether your business falls within the scope, start with a legal consultation.
The Act applies to processing of digital personal data within the territory of India where the data was collected in digital form, or in non-digital form and digitised subsequently (section 3(a)). It also applies outside India if the processing is in connection with any activity related to offering of goods or services to Data Principals within India (section 3(b)). Everything in section 3 is "subject to the provisions of this Act".
Section 3 at a glance
| Clause | What it covers | Key words in the text |
|---|---|---|
| 3(a)(i) | Processing in India of personal data collected in digital form | "within the territory of India", "in digital form" |
| 3(a)(ii) | Processing in India of personal data collected in non-digital form and digitised subsequently | "digitised subsequently" |
| 3(b) | Processing outside India | "in connection with any activity related to offering of goods or services to Data Principals within the territory of India" |
| 3(c) | Exclusions (personal or domestic use; data made publicly available) | covered in a separate article |
Clause (a): processing within India
The test has three parts: the processing happens within the territory of India; the data is digital personal data (section 2(n)); and it was either collected in digital form or was collected in paper form and then digitised.
Two things follow.
- Location of the processing matters, not the nationality of the individual. The text speaks of processing "within the territory of India". A foreign visitor whose details are entered into an Indian hotel's booking system is within the clause, because the processing is in India. The Act does not limit this clause to Indian residents or citizens.
- Paper records are caught once digitised. A business that collects forms on paper and later keys them into a system is covered from the point of digitisation, because section 2(x) defines processing on digital personal data.
Note that clause (a) covers the processing by any Data Fiduciary or Data Processor in India. Whether a duty falls on the fiduciary or the processor depends on the section, and section 8(1) makes the fiduciary responsible for processing on its behalf by a processor.
Clause (b): processing outside India
Clause (b) says the Act "also" applies to processing of digital personal data outside India if the processing is in connection with any activity related to offering of goods or services to Data Principals within India. Three features of the wording stand out.
- It is tied to offering goods or services. The text does not say "monitoring" or "profiling"; the hook is the offering.
- The Data Principals must be within the territory of India. The clause is concerned with where the individual is when goods or services are offered, not with her citizenship.
- The link is "in connection with any activity related to" the offering. That is a wide connecting phrase. A foreign app that sells subscriptions to users in India and processes their data on overseas servers is an obvious example.
The Act does not define "offering of goods or services", so the ordinary meaning applies. It also does not list factors such as currency, language or advertising. Do not read in tests that the text does not contain.
How this fits with cross-border transfers
Clause (b) is about foreign processing of data of people in India. A related but separate question is whether an Indian Data Fiduciary may send data abroad. That is section 16, under which the Central Government may restrict transfer to notified countries or territories. A company can be covered by section 3(a) for its Indian processing and also by section 16 for a transfer, and section 17(1)(d) contains a separate exemption for processing of data of Data Principals not within India under a contract with a foreign person. See the article on section 16 in this cluster and our overview of cross-border data transfer under the DPDP Act.
What section 3 does not say
- It does not list sectors. The Act is general and applies to businesses, professionals, government bodies and others that process digital personal data.
- It does not contain a size threshold. Startups and small businesses are not excluded by section 3; any relief comes only from a notification under section 17(3).
- It does not say the Act applies to non-personal data, or to data of companies. The definition of personal data concerns individuals.
Practical examples
Example 1: clinic with paper files. A clinic takes paper intake forms and later types them into its software. The Act applies to the clinic's processing from the point of digitisation, under section 3(a)(ii).
Example 2: overseas e-learning platform. A platform based abroad offers paid courses to learners in India and stores learner details on servers outside India. The processing is in connection with offering services to Data Principals in India, so section 3(b) applies.
Example 3: Indian outsourcing unit. An Indian company processes data of overseas customers under a contract with a foreign client. Section 3(a) may bring the processing within the Act, because it happens within India, but section 17(1)(d) contains a specific exemption for that situation, which you should read with its conditions. See section 17(1)(d) to (f).
Common mistakes
- Assuming the Act covers only Indian citizens. The hook is where the processing happens and, for foreign processing, where the Data Principals are.
- Assuming a foreign business is outside the Act because its servers are abroad. Clause (b) is aimed at exactly that.
- Ignoring paper data that will be digitised later.
Need help with whether the DPDP Act applies to you?
If you are a foreign business selling into India, or an Indian business with overseas clients, the scope question usually comes first. Our legal consultation team can review your processing locations and customer base against section 3 and the related exemptions.
Key takeaways
- Section 3(a) covers processing in India of digital personal data, including paper data digitised later.
- Section 3(b) covers processing outside India linked to offering goods or services to Data Principals in India.
- The Act is not limited to Indian citizens; location of processing or of the Data Principal is the test.
- Section 3 has no size threshold; relief for small entities depends on notification under section 17(3).
- Exclusions sit in section 3(c) and are covered separately.
Read next
- Introduction to the Digital Personal Data Protection Act, 2023
- Section 3 of the DPDP Act, 2023: personal or domestic use and publicly available data
- Section 2 of the DPDP Act, 2023: definitions of data and processing
- Cross-border data transfer under the DPDP Act
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.