1. Executive Summary: What's In, What's Out

Section 3 defines the APPLICATION of DPDPA - which data processing is subject to the law, and which is exempt.

1.1 Quick Reference: Covered vs Exempt

2. Section 3(1): Positive Scope - What's Covered

Statutory Language: "This Act shall apply to the processing of digital personal data within the territory of India where such personal data is processed for the purpose of offering goods or services to the Data Principals within India."

2.1 Three Elements Required

2.2 "For the purpose of offering goods or services"

This phrase LIMITS scope - not ALL processing is covered

2.3 What "Goods or Services" Means

3. Section 3(2)(a): Personal or Domestic Purpose

Statutory Language: "personal data processed by an individual for any personal or domestic purpose"

This is the "household exemption" - your personal use of data is not regulated

3.1 What is "Personal or Domestic Purpose"?

3.2 When Personal Use BECOMES Business Use (Exemption Lost)

3.3 GDPR Comparison: Household Exemption

GDPR Recital 18: "This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity"

CJEU Case: Bodil Lindqvist (C-101/01, 2003)

• Woman published names, photos, personal info of church colleagues on website
• Claimed household exemption
• Court ruled: Publishing on website = publicly accessible → ✗ NOT household exemption

Lesson for India: Section 3(2)(a) exemption is NARROW - only truly personal/domestic use, not public dissemination

4. Section 3(2)(b): Publicly Available Data

Statutory Language: "personal data that is made or caused to be made publicly available by the Data Principal or any other person under any obligation under any law for the time being in force in India, to whom such personal data was provided"

Two Scenarios Exempt:

1. Data Principal makes it public themselves
2. Someone else makes it public BECAUSE law requires it

4.1 Scenario 1: Data Principal Makes Data Public

4.2 Scenario 2: Made Public Under Legal Obligation

4.3 Important Limitation: Exemption is NARROW

Exemption applies to PROCESSING THE PUBLIC DATA ITSELF

Does NOT exempt: Combining public data with non-public data, or using it for purposes beyond reasonable expectations

Example:

• Company directors' names public on MCA → Processing those names = exempt
• BUT combining those names with scraped social media data, personal financial data → NOT exempt for the additional processing

5. Section 3(2)(c): Enforcing Legal Rights or Claims

Statutory Language: "personal data processed to enforce any legal right or claim"

Rationale: Legal proceedings require data processing - can't make this subject to consent/notice requirements

5.1 What is "Enforcing Legal Right or Claim"?

5.2 Boundaries of Exemption

5.3 Overlap with Section 17(1)(d)

Section 17(1)(d): Complete exemption for "processing... in the course of any judicial proceeding"

Section 3(2)(c): Exemption for "processing to enforce any legal right or claim"

Difference:

• Section 17(1)(d) = Broader (judicial proceedings + exercising rights before courts)
• Section 3(2)(c) = Narrower (enforcing legal rights/claims)
• Substantial overlap, but Section 17(1)(d) is complete Act-wide exemption, Section 3(2)(c) just excludes from application

6. Section 3(2)(d): Journalism, Academic, Artistic, Literary

Statutory Language: "personal data processed by a person in the course of journalistic activities or for academic, artistic or literary purpose"

This is the "free expression" exemption - balances data protection with freedom of speech/expression (Article 19(1)(a))

6.1 Journalistic Activities

6.2 Academic Purpose

6.3 Artistic Purpose

6.4 Literary Purpose

6.5 Balancing Act: Free Expression vs Privacy

Constitutional Tension:

• Article 19(1)(a): Freedom of speech and expression (journalism, art, literature)
• Article 21: Right to privacy (Puttaswamy - includes data protection)

Section 3(2)(d) Resolves Tension: Exempts journalism/academic/artistic/literary from data protection law, recognizing free expression importance

Judicial Test (When Conflict Arises):

1. Is it genuinely journalism/academic/artistic/literary? (Not just claimed for exemption)
2. Is processing necessary for that purpose? (Proportionality)
3. Does it serve public interest? (Journalism - public right to know)
4. Is privacy harm minimized? (Anonymization where possible, not gratuitous)

7. Philosophical Foundations: Balancing Rights

7.1 John Stuart Mill: Harm Principle

Mill's Principle (On Liberty, 1859): "The only purpose for which power can be rightfully exercised over any member of a civilized community, against his will, is to prevent harm to others."

Application to Section 3(2):

• Personal/domestic use (3(2)(a)) harms no one → Exempt
• Journalism (3(2)(d)) serves public good, minimal harm if responsible → Exempt
• Legal rights (3(2)(c)) necessary for justice → Exempt

7.2 Isaiah Berlin: Negative vs Positive Liberty

Negative Liberty: Freedom FROM interference

Positive Liberty: Freedom TO do things

Section 3(2) Exemptions Protect:

• Negative Liberty: Freedom from state intrusion into personal/domestic sphere (3(2)(a))
• Positive Liberty: Freedom to speak, write, create, litigate without data protection bureaucracy (3(2)(c), (d))

8. Comparative Analysis: GDPR, CCPA Scope

9. 50+ Practical Scenarios: DPDPA Applies or Not?

10. Conclusion: Defining the Battlefield

Section 3 draws the boundaries of DPDPA - it separates what's IN from what's OUT.

Key Principles:

1. Default Rule (3(1)): DPDPA applies to processing of digital personal data for offering goods/services to Indians
2. Four Exemptions (3(2)):
   • (a) Personal/domestic use
   • (b) Publicly available (voluntarily or legally required)
   • (c) Enforcing legal rights/claims
   • (d) Journalism/academic/artistic/literary
3. Exemptions are NARROW: Courts will interpret restrictively - exemption is exception, not rule
4. Exemptions Balance Rights: Privacy vs Free Expression, Privacy vs Access to Justice, Privacy vs Personal Autonomy
5. Commercial Activity ≠ Exemption: Moment processing becomes business/commercial, personal/domestic exemption lost
6. Public ≠ Unprotected: Even publicly available data has some DPDPA protections (though exempted from application, other laws may apply)
7. Purpose Matters: Same data processing may be exempt or not depending on PURPOSE (journalism = exempt, business use of same data = not exempt)

Practical Takeaway:

For Organizations:

• Assume DPDPA applies unless clearly exempt
• Don't try to stretch exemptions - they're narrow
• If mixed activity (e.g., media with ads), DPDPA applies to non-exempt parts

For Individuals:

• Your personal use = exempt (breathe easy)
• But companies processing your data = not exempt (they must comply)
• Your public posts = may be processed, but platform still subject to DPDPA

Section 3 ensures DPDPA is comprehensive but not totalitarian - it protects where protection is needed, exempts where freedom requires breathing room.