Prepared by Shubhank Suman, AI, Privacy, and IP Counsel
1. Statutory Framework
Section 3(b) of the Digital Personal Data Protection Act, 2023 provides that the Act shall: “also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India.” Section 3(b) is therefore the Act’s principal extraterritorial provision. It is capable of applying to a foreign entity even if that entity is incorporated outside India, has no office in India and processes the relevant personal data on servers located abroad. The controlling requirements are that:
1.there must be processing of digital personal data; 2.the processing must take place outside India; 3.there must be an activity related to offering goods or services; 4.the goods or services must be offered to Data Principals within India; and 5.the foreign processing must be in connection with that activity.
Section 3(b) does not expressly use the words “targeting”, “intention” or “directing activities”. Nor does the Act contain a recital explaining when a foreign website will be regarded as offering goods or services in India. The statutory text must therefore be interpreted by distinguishing a deliberate India-facing offer from the mere worldwide availability of online content.
Factual situation | Likely application of Section 3(b) |
|---|---|
A foreign website is technically accessible from India, but contains no India-facing content or functionality | Ordinarily insufficient by itself |
The website quotes prices in INR, accepts Indian addresses, advertises in India or expressly serves Indian users | Strong indication that goods or services are offered in India |
An Indian user independently accesses and registers on an undifferentiated foreign website | Not necessarily sufficient without further evidence of an India-facing offer |
A free application is specifically marketed to users in India and collects their data | Likely covered, even though no payment is made |
A foreign website merely collects cookies or analytics data when an Indian user visits it | Uncertain and arguably outside Section 3(b), unless the collection is connected with an India-facing offer |
A foreign publisher passively makes articles available worldwide and incidentally receives Indian visitors | Ordinarily outside Section 3(b), absent evidence that the service is offered to persons in India |
A foreign platform deliberately provides accounts or digital services to users located in India | Likely covered, if the related processing occurs outside India |
2. The Core Question: Accessibility Or Targeting?
The internet ordinarily makes a website accessible from almost every country. If accessibility alone amounted to offering goods or services in India, almost every foreign website collecting an IP address, cookie identifier or account detail from an Indian visitor could potentially fall within Section 3(b). Such an interpretation would largely eliminate the territorial limitation contained in the words “offering of goods or services to Data Principals within the territory of India”. The better view is that mere accessibility of a foreign website from India should not, without more, be treated as an offer of goods or services to persons in India. There must be some objective evidence that the foreign entity has made its goods or services available to individuals located in India, rather than merely operating a website which an Indian user happens to visit. This distinction has persuasive support in Article 3(2)(a) of the General Data Protection Regulation. That provision applies to a controller or processor outside the European Union where processing relates to the offering of goods or services to data subjects in the Union. Recital 23 clarifies that mere accessibility of a website, email address or contact details within the Union is insufficient. The relevant question is whether it is apparent that the organisation envisages offering goods or services to persons in one or more EU Member States.
The European Data Protection Board similarly treats Article 3(2) as a “targeting criterion”. Its Guidelines 3/2018 indicate that the individual must be located in the Union at the relevant time and that the organisation’s apparent intention to offer goods or services must be assessed from the surrounding facts. Incidental or inadvertent accessibility is not enough.
Although the GDPR materials are not binding when interpreting the Indian Act, they are useful by analogy because the two provisions employ a similar “offering of goods or services” formulation. The analogy should nevertheless be used carefully. Section 3(b) must ultimately be interpreted from its own text, statutory scheme and Indian context.
3. Dissecting “In Connection With Any Activity Related To Offering Of Goods Or Services”
The key statutory phrase contains two connecting expressions:
- “in connection with”; and
- “any activity related to offering”.
These words indicate that the processing need not itself constitute the sale or delivery of the goods or services. It is sufficient if the processing has a real and identifiable connection with an activity related to the offer. The provision can therefore extend across the commercial or service-delivery chain.
For example, where a foreign e-commerce platform sells goods to persons in India, the following processing may all be connected with the India-facing offer:
- creating customer accounts;
- processing orders;
- authenticating users;
- arranging delivery;
- providing customer support;
- processing payments or refunds;
- preventing fraud;
- maintaining purchase histories; and
- analysing use of the service.
The words “any activity related to offering” accordingly prevent Section 3(b) from being confined to personal data collected at the final checkout stage. Advertising, registration, onboarding, fulfilment, support and service administration may each be related to the offer.
However, these broad connective words do not eliminate the requirement for an underlying offer to Data Principals within India. The phrase should be read as establishing a relational test:
Is the particular processing sufficiently connected with an activity through which goods or services are offered to persons located in India?
The provision is not triggered merely because three independent facts coexist: the entity has a website, an individual is in India and some personal data is collected. The processing must be connected with the relevant India-facing offer.
Illustration 1: Foreign Online Retailer
A retailer incorporated in France displays prices in INR, delivers products to Indian addresses, purchases advertisements directed at Indian consumers and collects names, addresses and payment details during checkout. Its overseas processing is directly connected with offering goods to Data Principals in India. Section 3(b) would ordinarily apply.
Illustration 2: Local Foreign Retailer
A small retailer in France operates a French-language website, accepts delivery only within France and quotes prices only in euros. An Indian tourist planning a trip visits the website from India, subscribes to its mailing list and provides an email address. The website was accessible in India and data was collected from a person located in India, but there is no clear activity offering goods or services to persons in India. Section 3(b) should not automatically apply.
Illustration 3: Global Software Service
A US software provider permits account creation from India, lists India as a supported market, offers an Indian customer-support channel and actively markets subscriptions to Indian businesses. Processing Indian users’ account identifiers, billing details and usage records on overseas servers would ordinarily be connected with offering services in India.
These illustrations show that the place from which a website is accessed is relevant, but not conclusive. The character of the underlying offer remains central.
4. Objective Indicators Of An India-Facing Offer
Whether goods or services are offered to Data Principals in India should be assessed from the overall factual circumstances. Relevant indicators may include:
1.prices displayed in Indian Rupees; 2.delivery to Indian addresses; 3.India appearing as a selectable country or market; 4.an India-specific domain name, subdomain or webpage; 5.Hindi or another Indian language being used for ordering or service delivery; 6.advertisements directed specifically at users in India; 7.paid search optimisation for Indian searches; 8.references to Indian customers or users; 9.Indian telephone numbers, customer-support channels or service hours; 10.Indian payment methods, tax treatment or billing options; 11.availability of the application in an India-facing app marketplace; 12.promotional campaigns using Indian media or influencers; 13.terms, eligibility conditions or policies specifically addressing Indian users; and
No single indicator should necessarily be decisive. For example, English-language content has weak standalone significance because English is widely used internationally. Similarly, an international telephone number or global “country” menu may indicate worldwide availability, but it may not by itself establish that the organisation has made a meaningful offer to India. Currency, delivery, marketing, onboarding capability and actual service availability should be considered cumulatively.
This cumulative approach is consistent with the reasoning of the Court of Justice of the European Union in Peter Pammer v Reederei Karl Schlüter GmbH & Co. KG and Hotel Alpenhof GesmbH v Oliver Heller. In those joined cases, the Court considered whether a trader’s activity was directed to a consumer’s Member State. Mere website accessibility was not treated as determinative. Relevant factors included the international nature of the activity, foreign language or currency options, international contact details, country-linked domain names, search-engine expenditure and references to an international clientele.
Indian internet-jurisdiction jurisprudence also provides a useful, although not directly controlling, analogy. In Banyan Tree Holding (P) Limited v. A. Murali Krishna Reddy, the Delhi High Court considered whether website accessibility was sufficient to establish territorial jurisdiction in an online passing-off action. The Court rejected accessibility alone and examined purposeful availment, specific targeting and commercially meaningful interaction with users in the forum. The judgment arose under procedural and intellectual-property law, not the DPDP Act, but it supports the broader proposition that universal website accessibility should not automatically create territorial jurisdiction.
5. Collection Without An Activity Related To Offering Goods Or Services
The most difficult case is where a foreign entity collects digital personal data from a person in India but does not offer goods or services to India.
5.1 Passive Content Website
Suppose a local Canadian newspaper publishes regional news on a website which is accessible worldwide. It does not offer subscriptions in India, target Indian readers or carry India-facing advertising. An Indian visitor accesses an article and the website automatically receives the visitor’s IP address and device information.
The personal-data collection occurs because the Indian user accessed the website. Nevertheless, the processing may not satisfy Section 3(b) because no goods or services are apparently being offered to Data Principals in India. The incidental collection of technical data does not itself establish the missing territorial connection.
5.2 Analytics And Tracking
A foreign website may place analytics cookies on the device of a person in India and use this information to understand website traffic. If the website is not directed at India and offers no goods or services to persons in India, the tracking may fall outside Section 3(b) on a strict reading.
This differs materially from the GDPR. Article 3(2)(b) separately covers the monitoring of behaviour of data subjects where that behaviour takes place within the Union. Recital 24 explains that online tracking, profiling and the subsequent analysis or prediction of preferences, behaviour and attitudes may amount to monitoring. The DPDP Act contains no equivalent extraterritorial “monitoring of behaviour” limb.
Accordingly, behavioural tracking cannot automatically be imported into Section 3(b). It will be covered extraterritorially only where it is sufficiently connected to an activity related to offering goods or services in India. For example, behavioural analysis used to personalise an India-facing shopping platform would likely be connected with the offer. Analytics on a wholly foreign-facing informational website may not be.
5.3 Contact Forms And Unsolicited Enquiries
The existence of a generic contact form should not by itself establish an India-facing offer. If an Indian resident sends an unsolicited enquiry to a foreign business which does not operate in or serve India, the resulting collection of the person’s name and email address should not automatically bring all subsequent processing within Section 3(b).
The position may change if the foreign business accepts the enquiry, actively solicits the person’s custom and proceeds to offer or deliver its service to the person in India. The assessment is therefore factual and may change as the interaction develops.
5.4 Recruitment, Research And Non-Commercial Collection
A foreign entity may collect data from individuals in India for purposes such as recruitment, surveys, academic research, journalism or general website administration. Such processing is not naturally covered merely because it occurs through a website. The relevant question remains whether the processing is connected with an activity related to offering goods or services to Data Principals in India.
A recruitment application, for example, is ordinarily an application for employment rather than an offer of goods or services to the applicant. Unless another India-facing service is involved, Section 3(b) may not be the appropriate territorial gateway.
6. Meaning Of “Goods Or Services”, Including Free Services
The DPDP Act does not define “goods”, “services” or “offering”. A narrow reading would confine Section 3(b) to commercial transactions involving sale, remuneration or contractual consideration. That reading risks excluding many contemporary digital services which are supplied without a user-facing charge but are monetised through advertising, subscriptions paid by another party or exploitation of platform activity.
The GDPR removes this ambiguity by expressly providing that Article 3(2)(a) applies “irrespective of whether a payment of the data subject is required”. Recital 23 repeats this position.
Section 3(b) does not contain the equivalent express wording. Nevertheless, “services” should not necessarily be confined to paid services. Search engines, social-media platforms, email providers, online games and mapping applications provide recognisable services to users even where the user does not pay money. The more persuasive interpretation is that payment is relevant evidence of an offer but not an indispensable condition.
Accordingly, a foreign platform that deliberately markets a free application to persons in India, enables Indian users to create accounts and processes their account and usage data overseas may fall within Section 3(b). The absence of payment does not alter the fact that a digital service is being offered.
By contrast, a freely available webpage containing static information may not constitute an offer of services merely because it is useful to an Indian reader. The inquiry should focus on whether there is an identifiable service made available to persons in India and whether the relevant processing is connected with that service.
8. Practical Jurisdiction Test For A Foreign Website
A foreign entity assessing Section 3(b) may apply the following sequence:
First, identify the specific personal-data processing operation. Territorial scope should be assessed in relation to the relevant processing, not merely the entity’s global operations.
Second, determine whether the relevant individuals were within India when the goods or services were offered. Section 3(b) uses a location-based formulation, not nationality or permanent residence.
Third, identify the underlying goods or services. There should be an identifiable product, facility, digital functionality or benefit being offered.
Fourth, examine whether the offer was directed or made available to persons in India. Relevant evidence includes delivery, currency, market selection, advertising, language, support and onboarding functionality.
Fifth, determine whether the particular processing is connected with an activity related to that offer. Account creation, payment, fulfilment, customer support, fraud prevention and service analytics may satisfy this connection.
Sixth, distinguish the offer-related processing from unrelated activities. A foreign entity may be subject to Section 3(b) for its India-facing application while remaining outside Section 3(b) for an unrelated foreign publication or employment database.
Conclusion
Mere accessibility of a foreign website from India should not, without additional facts, confer jurisdiction under Section 3(b) of the DPDP Act. Website accessibility establishes only that a technical interaction with India is possible. It does not establish that the foreign entity is offering goods or services to Data Principals within India.
Section 3(b) is more appropriately applied where the factual circumstances show an intentional or objectively apparent India-facing offer and the overseas processing has a real connection with an activity related to that offer. INR pricing, Indian delivery, India-specific marketing, local support, Indian payment options, express market selection and deliberate onboarding of users located in India are strong indicators. These factors must be considered cumulatively rather than mechanically.
At the same time, the words “in connection with any activity related to offering” are broad. Once an India-facing offer is established, Section 3(b) may cover not only the immediate sale or supply of the service but also related registration, fulfilment, support, administration, security and analytical processing.