Section 3 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 3(c) takes two kinds of processing out of the Act: data processed by an individual for a personal or domestic purpose, and personal data that has been made publicly available by the Data Principal or by a person under a legal duty to publish it. The clause is short, but each word does work, and the Illustration attached to it shows how far it goes. For a borderline dataset, a legal consultation can help you record your reasoning.
The Act does not apply to (i) personal data processed by an individual for any personal or domestic purpose, and (ii) personal data made or caused to be made publicly available by the Data Principal herself, or by any other person who is under an obligation under any law in force in India to make it public. The Illustration says that when an individual blogs her views and puts her own personal data on social media, the Act does not apply. Business use of the same data is a different question.
The text at a glance
| Limb | Exclusion | Who must have made it |
|---|---|---|
| 3(c)(i) | Personal data processed by an individual for any personal or domestic purpose | An individual (not a company or firm) |
| 3(c)(ii)(A) | Personal data made or caused to be made publicly available | The Data Principal to whom it relates |
| 3(c)(ii)(B) | Personal data made or caused to be made publicly available | Any other person under an obligation under any law in force in India to make the data public |
Limb (i): personal or domestic purpose
Section 3(c)(i) speaks of "personal data processed by an individual" for a "personal or domestic purpose". Two points are clear from the text.
- Only an individual qualifies. A company, firm or association is not an individual, so this limb does not help a business, even a one-person business operating through a firm.
- The purpose must be personal or domestic. Keeping a phone contact list of friends and family, or a household address book, fits. Using contacts to run a side business does not obviously fit, because the purpose then goes beyond personal or domestic. The Act does not define either phrase, so the ordinary meaning applies and the facts decide.
The Act gives no test for borderline cases, such as a freelancer who keeps a mixed list. A careful approach is to treat commercial use as outside the exclusion and to handle that data under the normal duties.
Limb (ii)(A): made public by the Data Principal
If the Data Principal herself makes her personal data publicly available, the Act does not apply to that data. The Illustration in the Act gives the example: X, an individual, while blogging her views, has publicly made available her personal data on social media, and the provisions of the Act do not apply.
The clause says "made or caused to be made publicly available". So it covers data the individual posts herself and also data she has caused to be made public, for instance by asking someone to publish it on her behalf. It does not cover data that a third party publishes without her involvement; that case is not in limb (ii)(A).
Limb (ii)(B): made public under a legal duty
The second branch covers personal data made public by "any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available". The text does not name examples. The key is the source of the duty: the publisher must be under a legal obligation in India to publish. A person who publishes voluntarily, without a legal duty, does not fit this branch.
Because the exclusion applies to "personal data that is made or caused to be made publicly available" by such a person, it turns on who did the publishing and why, not on whether the data is easy to find online.
What the exclusion does not do
This is where readers most often go wrong.
- It removes the Act's application to that data, but it is not a licence for every downstream use. Other laws (for example those on defamation, cyber offences or sector rules) are unaffected by section 3(c). Section 38(1) says the Act is in addition to other laws.
- It does not cover data merely found online. Scraped data that a third party, not the Data Principal or a person under a legal duty, made public does not fit limbs (ii)(A) or (ii)(B) on the text.
- It does not exempt the State or businesses as such. Exemptions for the State and for specific purposes sit in section 17, not here.
- It is part of the Act's scope, not an exemption from a section. Section 3(c) says the Act does "not apply" at all to such data, unlike section 17, which switches off named provisions.
How it fits with consent and legitimate uses
If data falls outside the Act by section 3(c), the grounds in section 4 and the consent rules in section 6 do not come into play for that data. If it falls inside the Act, the business needs a section 4 ground, which means consent under section 6 or a legitimate use under section 7. Section 7(a) covers data that a Data Principal voluntarily provides for a specified purpose, which is a narrower idea than public availability. See the article on section 4 and grounds for processing.
Practical examples
Example 1: household contacts. An individual keeps her family's phone numbers in her phone to call them. This is personal or domestic processing by an individual, so section 3(c)(i) applies.
Example 2: public blog. A blogger posts her own email address and views on a public page. The data was made publicly available by the Data Principal. A marketing company that wants to process it should check whether the exclusion applies to the data as posted; under the Illustration, the Act does not apply to that data.
Example 3: mixed list. A tutor keeps a list of parents' numbers for her classes that she charges for. She should treat this as business processing. Whether she is an individual acting for a personal purpose is doubtful, so she should not assume the exclusion.
Common mistakes
- Treating any data found on the internet as outside the Act. The text looks at who made it public.
- Relying on the personal use limb for a business. Only an individual for a personal or domestic purpose qualifies.
- Assuming other laws stop applying. Section 38(1) keeps them in place.
Need help with DPDP scope questions?
If you are deciding whether a dataset is outside the Act, or how to treat information you collect from public sources, it helps to record your reasoning. Our legal consultation service can review the facts with you and help you document the position.
Key takeaways
- Section 3(c)(i) excludes personal or domestic processing by an individual.
- Section 3(c)(ii) excludes personal data made public by the Data Principal or by a person under a legal duty to publish it.
- Business use does not fit the personal or domestic limb.
- Data scraped from a third party's publication is not covered on the text.
- The exclusion is about the Act's scope; other laws continue to apply under section 38(1).
Read next
- Section 3 of the DPDP Act, 2023: application inside and outside India
- Section 4 of the DPDP Act, 2023: grounds for processing personal data
- Introduction to the Digital Personal Data Protection Act, 2023
- DPDP compliance checklist for businesses
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.