India’s Digital Personal Data Protection Act takes a different approach to public data from Europe’s. The GDPR applies to personal data wherever it was found. India’s law, by contrast, says it does not apply to some personal data that is already public. For teams that collect web data with compliance in mind, that sounds like a simple answer. It is not, and the timing matters as much as the wording.
This guide covers what the Act says about public data, when it takes effect, what it requires when the exclusion does not apply, and how to prepare. It is general information, not legal advice.
Where the law stands
The Act received presidential assent on 11 August 2023. The government notified the DPDP Rules and the commencement dates in November 2025, in three stages.
| Stage | Date | What commences |
|---|---|---|
| On publication | 13 November 2025 | Definitions, the Data Protection Board and its set-up rules |
| After one year | November 2026 | Consent manager provisions |
| After 18 months | 13 May 2027 | Scope (section 3), notices, consent, legitimate uses, duties, rights, exemptions, the Board’s enforcement powers and penalties |
Some summaries count from 14 November, the date the Gazette was signed, which moves each stage by a day. Either way, the main obligations, and even the section that sets the Act’s scope and its public data exclusion, are enacted but not yet in force. Until then, the older rules under section 43A of the IT Act still apply to sensitive personal data.
In early 2026 the government consulted on bringing some obligations forward to 12 months for the largest data fiduciaries. As of this writing we have not found a notification making that change, so check the Gazette before relying on the 2027 date.
The public data exclusion
Section 3(c)(ii) says the Act does not apply to “personal data that is made or caused to be made publicly available by” either:
- “the Data Principal to whom such personal data relates”, or
- “any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available”.
The Act gives one illustration: “X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.”
The test is who made the data public, not whether it is public now. Three cases show the difference.
| Data | Who made it public | Excluded? |
|---|---|---|
| A professional’s own profile or blog post | The person themself | Yes, on the wording |
| A company director’s details in a statutory register | Someone legally required to publish | Yes, on the wording |
| A news article, review or repost naming a person | A third party with no legal duty | No |
Much of what a crawler collects is the third kind: names in articles, reviews, comments and directories compiled by others. The exclusion does not reach that data. The Act also does not say whether data stays excluded once it is combined with other sources or used to profile someone, and there is no official guidance on the point yet.
In practice, you need to know the origin of each record. A dataset that mixes self-published data with third-party data cannot rely on the exclusion as a whole.
When the exclusion does not apply
For personal data outside the exclusion, the Act is strict.
No legitimate interests. Processing is lawful only with consent or for “certain legitimate uses”. Those uses are a closed list: data a person gave voluntarily for a specified purpose, state functions, legal obligations, court orders, medical emergencies, disasters and employment. There is no general balancing test like the GDPR’s legitimate interests. Our guide to GDPR and residential proxies covers how Europe handles the same question.
Consent is demanding. It must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, and preceded by a notice. Consent is rarely practical for data collected from the web.
Research has its own exemption. Section 17(2)(b) says the Act does not apply to processing “necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal”, carried out under prescribed standards. The Rules set those standards: lawful processing, only the data needed, reasonable accuracy, limited retention, security safeguards and clear accountability. This exemption also starts in May 2027.
Reach beyond India. The Act applies to processing outside India when it is “in connection with any activity related to offering of goods or services to Data Principals within the territory of India”. A team abroad building a dataset of Indian consumers to sell to them should assume it may be covered.
Penalties
Penalties are set per breach and “may extend to” the amounts below. They apply from May 2027.
| Breach | Up to |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Failing to notify a personal data breach | ₹200 crore |
| Breaching obligations for children | ₹200 crore |
| Breaching obligations of significant data fiduciaries | ₹150 crore |
| Breach of any other provision | ₹50 crore |
₹250 crore is 2.5 billion rupees. The Board decides the amount case by case.
The other law to remember
The DPDP Act is not the only Indian law that touches web data. Section 43 of the IT Act makes a person liable to pay compensation if, “without permission of the owner” of a computer system, they access it or download, copy or extract data from it. That turns on permission, not on personal data, so a site’s terms and access controls matter separately from anything in the DPDP Act. Our guide to what legal will ask before a scraping project covers how to assess those questions together.
How data teams should prepare
- Map Indian personal data. Find which sources and fields hold personal data about people in India, and whether your use is connected to offering them goods or services.
- Record who published each record. Tag data as self-published, legally published or third-party. Only the first two can rely on the exclusion. Our guide to provenance in the AI training pipeline shows a record format that holds this.
- Drop what you do not need. Third-party personal data with no lawful route should be filtered at collection, not after.
- Test any research claim. If you rely on the research exemption, document the purpose, confirm no decisions are made about individuals, and meet the standards in the Rules.
- Plan for May 2027. Treat it as the deadline, and watch for any notification that brings dates forward or restricts transfers to particular countries.
Where proxies fit
A proxy changes where a request comes from, not what the law allows. Collecting Indian personal data through an Indian IP, or any other, does not change whether the DPDP Act applies or which exclusion you rely on. Residential proxies are useful for seeing public pages as local visitors in India see them, for work such as price monitoring, ad verification and localisation checks, which usually involve little or no personal data.
The bottom line
India’s DPDP Act excludes personal data that people publish about themselves, but not personal data that others publish about them, and it has no legitimate interests basis to fall back on. Most of its obligations start on 13 May 2027, including the exclusion itself. Use the time to map what Indian personal data you hold, record who published each record, and build collection that keeps only what you can justify. For a comparison with another recent change, see our guide to the UK’s Data (Use and Access) Act.
Sources and references
- Digital Personal Data Protection Act, 2023, Gazette of India (11 August 2023): egazette.gov.in
- Commencement notification, G.S.R. 843(E) (November 2025): egazette.gov.in
- Establishment of the Data Protection Board, G.S.R. 844(E) (November 2025): egazette.gov.in
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E): egazette.gov.in
- Press Information Bureau, DPDP Rules backgrounder (November 2025): pib.gov.in
- S.S. Rana and Co., MeitY plans to cut short the DPDP compliance timeline (13 February 2026): ssrana.in
- Information Technology Act, 2000, section 43 (text via CIS): cis-india.org
- General Data Protection Regulation, Regulation (EU) 2016/679: eur-lex.europa.eu