Material And Territorial Scope Of The Digital Personal…

Regulatory Evasion Via Non-Digitisation

Can entities bypass DPDPA by maintaining paper-based records?

Scraping Of Publicly Available Images

Is the processing of photographs, phone numbers, and email addresses available on public platforms such as

LinkedIn and Facebook permitted under the DPDPA?

Personal Purpose Exemption

Where's the boundary between private processing and commercial dissemination?

Commercial Threshold

When does personal processing come within the scope of DPDPA?

Extra-Territorial Data Brokerage

Do foreign data brokers like Panama fall under the

DPDPA scope?

A Comprehensive Legal Analysis Prepared By Shubhank Suman- Privacy, AI, And Ip Counsel

The Digital Gatekeeper: Understanding Material Scope

The Digital Personal Data Protection Act, 2023 (DPDPA) fundamentally differs from the European Union's GDPR in one critical aspect: it is technologically specific rather than technologically neutral. This section lays out the precise scope of the DPDPA's application, defining when and where it applies to personal data processing in India.

Section 3: Application of Act

The provisions of this Act shall apply to-the processing of digital personal data within the territory of India where the personal data is:

collected in digital form; or collected in non-digital form and digitised subsequently;

the processing of digital personal data outside the territory of India, if such processing is in connection with any activity relating to offering of goods or services to Data Principals within the territory of India.

Provided that the provisions of this Act shall not apply to:

personal data processed by an individual for any personal or domestic purpose;

personal data that is made or caused to be made publicly available by:

the Data Principal to whom such personal data relates; or any other person who is under an obligation to make such personal data publicly available under any law for the time being in force.

Section 3 of the DPDPA 2023 acts as a selective gatekeeper, opening its regulatory doors only when data crosses into the digital realm or pertains to specific activities. Let's break down its key aspects:

Application Within India: The "Digital-Only" Rule (Section 3(a))

This crucial subsection establishes a binary regime with precision. The Act applies exclusively to personal data that is either collected in digital form or collected in non-digital form and subsequently digitised. This creates a stark divide: information remaining purely in analogue or physical form falls completely outside the DPDPA's regulatory reach. For vast segments of the Indian economy still reliant on physical paperwork, this distinction carries profound implications.

Born Digital (Section 3(a) (i))

Data originating in digital format is automatically covered from the moment of collection, including emails, server logs, app usage data, and biometric scans.

Subsequently Digitised (Section 3(a)(Ii))

The critical digitisation trigger occurs when non-digital records, like paper documents, are scanned, OCR-processed, or manually typed into digital systems, bringing them under DPDPA purview.

Remains Analogue (Exempt)

Physical records that never enter the digital realm remain entirely exempt from DPDPA obligations, regardless of their sensitivity or nature.

Extraterritorial Application (Section 3(b))

Beyond India's borders, the DPDPA reaches processors handling digital personal data if their activities are connected to offering goods or services to individuals (Data Principals) within India. This ensures that foreign entities targeting the Indian market are also held accountable to the Act's provisions.

Key Exemptions (Proviso To Section 3)

The Act carves out specific scenarios where its provisions do not apply:

Personal or Domestic Purpose (Section 3(c)(i)): Personal data processed by an individual solely for their own personal or household use is exempt, reflecting a common privacy law principle.

Scenario: The Party Planner Vs. The Shopkeeper

Actor	The Teenager	The Modern Shopkeeper
Activity	Creates a digital list of 50 friends' names and phone numbers on their smartphone to invite them to a birthday party.	Downloads an app like OkCredit and types 500 customers' names and numbers to track dues
Data Format	Digital	Digital
Purpose	Personal/Domestic	Commercial/Business
Analysis	Even though the data is digitized (just like the shopkeeper's app), the purpose is purely social.	The data has been subsequently digitized for a commercial purpose, making him a Data Fiduciary
VERDICT	EXEMPT	IN SCOPE

Key Insight: The "Digital Threshold" described in the sources is the first test. The "Personal Purpose" exemption is the second test. You can be digital but still exempt if you are acting as an individual, not a business.

Publicly Available Data (Section 3(c)(ii)): If personal data is intentionally made public by the Data Principal themselves, or by another party legally obligated to do so, its subsequent processing falls outside the Act's

scope. This acknowledges data shared in public forums or mandated disclosures.

Scenario: The "Secret" Ledger Vs. The "Public" Profile

Feature	The Kirana App Record	The Clearview AI Target
Source	Private Entry: The shopkeeper types the name into the app himself	Public Post: A user uploads their photo to Twitter/X and sets visibility to "Everyone" (from conversation history).
User Intent	Private: The customer expects confidentiality regarding their credit dues.	Public: The user intentionally shared this data with the world.
Legal Status	Protected. Because the data is digital and private, the shopkeeper is liable for its security	Unprotected. Even though the data is scraped into a massive digital database, the origin (public availability) negates the protection.
VERDICT	IN SCOPE	EXEMPT

The practical implications emerge starkly in everyday scenarios. A Kirana store owner maintaining a physical notebook (Khata) recording names, phone numbers, and credit dues of 500 residents operates

entirely outside the DPDPA's scope. The moment this shopkeeper downloads a bookkeeping app and types these details into a smartphone, the digitisation trigger activates, transforming the shopkeeper into a Data physically in a briefcase faces no DPDPA liability if those physical forms are lost or stolen, such physical records fall outside the DPDPA's scope. However, the moment these forms are digitized , for instance, by

Fiduciary with full compliance obligations. Similarly, an insurance agent carrying health declaration forms being scanned into the company's server , DPDPA liability immediately applies, as the records are now

digital and thus within the Act's purview.

This creates what legal scholars term 'regulatory arbitrage', a perverse incentive structure that effectively penalises modernisation. Entities handling highly sensitive data can legally bypass the entire Act by refusing to digitise, maintaining 'black books' or dossiers entirely on paper. A corporate HR department might maintain an 'official' digital file complying with DPDPA whilst keeping a "shadow" paper folder containing sensitive notes on union activities or health conditions, accessible only to management.

The legislative intent appears clear: reducing compliance burdens on India's vast unorganised sector, small shopkeepers, local moneylenders, and small clinics by using digitisation as a proxy for sophistication. However, this creates a massive gap where physical theft or loss of sensitive ledgers poses real privacy risks without legal recourse. If a bank discards thousands of physical loan applications containing PAN cards and phone numbers into a public dumpster, the DPDPA remains silent, a scenario that would constitute a catastrophic GDPR violation.

The Public Data Black Hole: Section 3(c) (Ii)

CRITICAL PRIVACY RISK

Section 3(c)(ii) stands as perhaps the most significant and controversial loophole in the entire Indian privacy framework. This provision explicitly states that the Act's provisions shall not apply to personal data made or caused to be made publicly available by either the Data Principal themselves or any person under legal obligation to do so. The legislative intent appears twofold: pragmatic recognition that regulating data already in the public domain is practically impossible, and strategic support for India's burgeoning AI and start-up ecosystem by removing legal friction for publicly available data.

This exemption fundamentally rejects the theory of 'contextual integrity' embraced by the GDPR. Under European law, personal data does not lose protection simply because it is public. If a user posts their photograph on LinkedIn for professional networking purposes, a third party scraping that photo to train facial recognition algorithms must still establish a valid lawful basis and provide the user with the right to object. The context matters; the data remains protected.

The DPDPA adopts a binary view: data is either private (protected) or public (unprotected). Once a Data Principal makes data public, the entire Act ceases to apply, creating three catastrophic consequences. First, completely alien purposes without legal hurdle.

scrapers require no consent. Second, users need not be informed their data has been harvested. Third, and most critically, purpose limitation evaporates, data shared for one purpose can be reprocessed for

User Posts Public Content

Individual shares photo on social media platform with specific intent (e.g., professional networking, social connection).

Mass Scraping Occurs

Third parties harvest data at scale without consent, notice, or purpose limitation under Section 3(c)

(ii) exemption.

Reprocessing For Alien Purposes

Data used for facial recognition, credit scoring, surveillance, or AI training—contexts never intended by user.

Permanent Loss Of Control

User has no right to access, correct, or delete data once it enters commercial databases through public exemption.

Consider the 'Clearview AI scenario' adapted to India. An Indian AI start-up develops a law enforcement tool by scraping millions of profile pictures from WhatsApp, Instagram, and X (Twitter) where users set visibility

to "Everyone." It builds a massive facial recognition database. Under GDPR, this activity is illegal, lacking lawful basis. Under DPDPA Section 3(c)(ii)(A), the Act does not apply, the start-up can harvest, store, and sell this biometric data without oversight because Data Principals voluntarily made photos publicly available.

The exemption extends to data published under legal obligation, electoral rolls, lists of directors, court judgements, and land records. A fintech company can scrape the e-Courts system, downloading thousands of judgements to extract names of individuals involved in cheque bounce cases or loan defaults, then sell this

"litigation history" to banks. Under Section 3(c)(ii)(B), the data was made public by the Judiciary under

legal obligation, rendering the fintech firm exempt from privacy obligations towards litigants.

Chilling Effect On Free Speech

Knowing 'public' means 'unprotected', users self-censor. Activists, journalists, and ordinary citizens withdraw from digital public squares to protect privacy.

Shadow Profiles

Data brokers legally build detailed profiles using only publicly available data, social media scrapes, land records, voter lists, with citizens having no right to access or correct inaccuracies.

Irreversible Exposure

Unlike consent which can be withdrawn, making data public is often irreversible. Once scraped and fed into AI models or broker databases, users lose control forever.

The food blogger who places their mobile number in their Instagram bio with the caption 'For Collabs Only' discovers their number scraped by telemarketing firms and sold to insurance agents who bombard them

with spam calls. By making the number public, the blogger waived protection under the Act. The DPDPA does not recognise intent limitation, the blogger cannot claim breach of purpose limitation because the Act

itself no longer applies to that data

Personal Exemptions And Territorial Gaps

The Household Sanctuary

Section 3(c)(i) creates a sanctuary for private life, ensuring data protection law does not crush ordinary social interactions. The provision exempts personal data processed by an individual for any 'personal or domestic purpose.' Without this exemption, an individual keeping a spreadsheet of wedding guests would technically be a

Data Fiduciary, legally required to issue Privacy Notices to every guest, an absurd and unenforceable scenario.

The European Court of Justice famously narrowed the household exemption in Frantisek Rynes (C-212/13).

Mr. Rynes installed CCTV on his home to deter thieves, but the camera also recorded the public footpath and neighbour's entrance. The Court held that because surveillance extended beyond the private sphere, it was not purely 'household' activity, Mr. Rynes was a Data Controller subject to GDPR.

DPDPA Ambiguity

The Indian Act uses 'personal or domestic purpose' without defining boundaries. Given India's density and prevalence of private security measures, strict

Rynes interpretation would turn millions of homeowners into non-compliant Data Fiduciaries overnight. Indian interpretation will likely be broader, focusing on intent (security/domestic) rather than strict geography.

The wedding guest recording a Sangeet ceremony video clearly identifying dozens of other guests, then sharing it on a family WhatsApp group, is exempt under Section 3(c)(i). The processing involves personal data of others, but the purpose is purely social and personal. Other guests cannot file DPDPA complaints demanding video deletion, though they might have remedies under general privacy or defamation laws.

However, significant grey areas emerge. When does a 'personal' social media account become a 'commercial' business? If a lifestyle influencer with one million followers posts a restaurant video of people without consent to generate revenue, is that still 'personal purpose'? The Act provides no threshold. This leaves substantial ambiguity where commercial data exploitation can masquerade as personal expression.

Recording and sharing wedding videos on family WhatsApp groups, exempt as purely personal purpose.

Home Security

CCTV capturing public roads for domestic security, likely exempt despite monitoring public space.

Contact Backups

Syncing 2,000 contacts to iCloud or Google Drive, classic personal purpose activity, user not a Fiduciary.

The Territorial Monitoring Gap

Section 3(b) establishes territorial scope through a two-tier test. Processing within India triggers applicability regardless of data subject nationality. Processing outside India triggers applicability only if in connection with offering goods or services to Data Principals within India. This 'effects doctrine' approach means foreign entities targeting the Indian market economically are subject to Indian law without requiring physical establishment.

However, the DPDPA diverges sharply from GDPR by omitting the 'monitoring behaviour' clause. The GDPR asserts jurisdiction over non-EU entities monitoring behaviour of EU individuals, specifically designed to catch the

'surveillance economy' of foreign ad-tech firms, data brokers, and profilers who do not sell products but merely track users via cookies, device fingerprinting, or GPS to build profiles.

Streamflix (In Scope)

US OTT platform accepting Indian credit cards, charging in INR, streaming Bollywood content, clearly offering services to Indian Data Principals.

Voteranalytics (Gray Area)

Panama data broker placing tracking pixels on websites visited by Indians, building psychometric profiles sold to US think tanks, monitoring behaviour but not offering services.

Le Monde (Out Of Scope)

French newspaper accessible in India but no India-specific subscription, paywall, or targeted advertisements, merely "available" not "offering."

This creates a massive loophole for foreign surveillance capitalism. VoterAnalytics Inc., a Panama-based data broker, places invisible tracking pixels on thousands of websites visited by Indians, tracking which political services to Indian Data Principals, the Indian user is not the customer but the resource. Under strict textual reading of Section 3(b), this Panama entity is untouchable. The DPDPA protects Indians from bad sellers but

articles users read to build psychometric voter profiles sold to US think tanks. They offer no goods or

not from bad spies.

Comprehensive Compliance Checklist

Before worrying about Notices, Consent Managers, or Data Protection Impact Assessments, Data Fiduciaries must determine if they are even on the playing field. The DPDPA is not universal but scoped law. This filter determines immediate regulatory status.

1 Is The Data Digital?

Data collected in digital form or non-digital data subsequently digitised is in scope. Paper records remaining on paper are out of scope. Do not digitise purely for convenience, keeping legacy records in physical storage is valid compliance strategy to avoid DPDPA liability.

2 Is The Data About An Individual?

Data relating to identified or identifiable natural persons is personal data. B2B corporate data (company turnover, generic email info@company.com) is out of scope. Mixed data about specific employees (rahul.sharma@company.com, salary) is in scope. Segregate databases accordingly.

3 Is Processing For Personal/Domestic Use?

Individuals processing data for purely personal or domestic purposes are exempt. Storing friends' numbers, family photos, organising private events is out of scope. Freelancers or influencers using personal data to generate revenue likely cross into commercial purpose, making them in scope.

4 Is The Data Publicly Available?

Personal data made publicly available by the Data Principal or by legal obligation is exempt. Data scraped from public LinkedIn/Twitter profiles is out of scope. Data from dark web leaks where users did not make it public is in scope. Data from government gazettes or court judgements is out of scope.

5 Territory Check: Where And Who?

Processing physically within India is in scope regardless of data subject nationality. Processing outside

India is in scope only if offering goods or services to Data Principals in India (shipping goods, taking INR payments, India-specific content). Foreign entities tracking Indians without selling to them currently slip through this net.

Feature	GDPR (European Union)	DPDPA (India)
Material Scope	Covers automated data AND manual data if part of filing system	Covers only digital data (born digital or subsequently digitised)
Territorial Scope	Establishment + Targeting (Goods/Services or Monitoring Behaviour)	Activity based (processing in India OR offering Goods/Services to India). Omits "Monitoring Behaviour"
Public Data	Regulated. Processing requires lawful basis (e.g., Legitimate Interest)	Exempt. Section 3(c)(ii) creates total exemption for data made public by Principal
Household Exemption	Strict. Narrowly construed (Rynes). Filming public street NOT exempt	Broad. Exempts personal or domestic purpose." Likely broader interpretation
Lawful Basis	Pluralistic (6 bases): Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests	Binary (2 bases): Consent OR Certain Legitimate Uses (closed list)

If you check "in scope" for material scope (digital) AND territorial scope, AND you do not fall into the public/domestic exemptions, you are subject to the full compliance framework of the DPDPA. The Act's scoped nature means many entities escape regulation entirely but those within its reach face comprehensive obligations regarding notice, consent, security, and accountability.