Where the Act Applies, and Where It Does Not

In one line

The Act applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India, and it does not apply to personal or domestic processing or to personal data made publicly available.

The provision

"Subject to the provisions of this Act, it shall,"

(a) apply to the processing of digital personal data within the territory of India where the personal data is collected

• (i) in digital form; or
• (ii) in non-digital form and digitised subsequently;

(b) also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;

(c) not apply to

• (i) personal data processed by an individual for any personal or domestic purpose; and
• (ii) personal data that is made or caused to be made publicly available by
• (A) the Data Principal to whom such personal data relates; or
• (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

Illustration. "X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply."

Clause (a): the territorial application

Two conditions. The processing must be within the territory of India, and the data must have been collected in digital form, or in non-digital form and digitised subsequently.

The words "collected in digital form" do a lot of work. The Act follows the data from the moment of collection. So a form filled in on paper and then scanned into a system is caught, because it was digitised subsequently, and a form filled in on paper and filed in a cabinet is not.

But note what is not in clause (a): a nationality or residence qualification. Processing in India of the personal data of a person anywhere in the world is caught. The Act protects data, not Indians.

Clause (b): the extraterritorial application

Processing outside India is caught if it is "in connection with any activity related to offering of goods or services to Data Principals within the territory of India".

Read the chain of qualifiers: in connection with an activity related to the offering of goods or services. Four links, each of which widens the provision. Processing need not itself be the offering; it need only be connected with an activity related to it.

This is the European trigger, copied from Article 3(2)(a) of the Regulation, and it is why a foreign company selling into India cannot ignore the Act.