DPDP Act Compliance: Using Publicly Available Personal Data in India

Many businesses rely heavily on publicly available data for market research, lead generation, recruitment, and artificial intelligence development. With the phased rollout of India’s Digital Personal Data Protection (DPDP) Act leading up to full enforcement by May 13, 2027, organizations need to understand how the new legal framework applies to information that is already in the public domain.

The central provision addressing this is Section 3(c)(ii) of the DPDP Act.

Understanding the Section 3(c)(ii) Exclusion

The DPDP Act provides a specific exclusion for certain publicly available personal data. According to Section 3(c)(ii), the Act does not apply if the personal data was made public in one of two ways:

  1. The individual (the Data Principal) voluntarily made the data publicly available.
  2. Another person published the data because they were under a legal obligation under Indian law to do so.

For example, if a professional voluntarily publishes their work history on a public networking profile, or if a company director’s details are published in statutory corporate filings, the DPDP Act does not apply to that specific information.

The legal test is narrow. Just because data can be found on the internet does not mean it automatically qualifies for this exclusion. Information obtained through data breaches, unauthorized access, or by bypassing platform privacy settings does not fall under Section 3(c)(ii).

Impact on Web Scraping and AI Data Collection

For organizations relying on web scraping, data aggregation, or AI model training, the origin of the data is the primary compliance metric.

The Burden of Proof and Republished Data The burden of proof lies entirely on the data fiduciary. In the event of a regulatory audit, the company must prove the individual voluntarily made the data public. It is insufficient to merely demonstrate that the company found the data on a public website. When scraping large volumes of records, there is a high risk of collecting data illegally published by a third party. Companies must implement filtering mechanisms to exclude data from known breach sites, secondary data aggregators, or unauthorized forums.

Data Aggregation and Tainted Datasets Combining multiple public data points to build consumer profiles or recruitment databases does not automatically void the statutory exclusion, provided the origin of all aggregated data points can be traced back to the Data Principal. If a company mixes Section 3(c)(ii) exempt data with non-exempt scraped data, the entire resulting profile or dataset becomes subject to the Act’s compliance requirements.

AI and Large-Scale Processing The DPDP Act does not have a separate carve-out specifically for AI training datasets. Companies using public data to train, test, or evaluate AI models must individually assess whether the input data falls under the statutory exclusion. Automated data collection must also comply with other legal boundaries, including platform terms of service and intellectual property rights.

Immediate Compliance Steps for Businesses

With the next phase of the DPDP rules scheduled to take effect on November 13, 2026, organizations should use the transition period to audit their data pipelines. Key actions include:

  • Map Data Sources: Identify every platform, public registry, and third-party vendor supplying publicly available data to your systems.
  • Establish Provenance: Document exactly how the data entered the public domain and maintain verifiable records to prove it strictly meets the Section 3(c)(ii) definition.
  • Review Collection Methods: Ensure data scraping or collection practices do not violate third-party contractual restrictions or platform terms of use.
  • Audit Third-Party Vendors: If the company licenses datasets from external providers, conduct thorough due diligence to confirm the vendor has documented the legal provenance of the data.

DISCLAIMER: The information provided in this post is for general informational and educational purposes only and does not constitute legal, financial, or professional advice. While every effort has been made to ensure accuracy based on recent regulatory notifications, data privacy laws and compliance requirements are subject to interpretation and change. Businesses are strongly advised to consult with certified legal professionals and data privacy experts to evaluate how the Digital Personal Data Protection (DPDP) Act specifically applies to their operations and data collection methods before implementing any changes.