'It's already public, so we can use it' is a common assumption — and a risky one. The DPDP Act does treat certain publicly available data differently, but the exemption is narrower than people hope.
What the Act says
The Act's provisions don't apply to personal data that the Data Principal themselves has made publicly available, or that is made public under a legal obligation. The key is who made it public and how.
The limits that catch people
- Data someone else posted about a person isn't 'made public by the Data Principal'.
- Scraping and re-purposing public profiles for new uses is risky.
- Aggregating public data into profiles can create fresh privacy harm.
- Sensitive inferences from public data still carry risk.
A cautious stance
Don't assume 'public' means 'free to use for anything'. Check whether the person made it public themselves and for what purpose, and avoid building intrusive profiles.
How DPDP Bridge helps
DPDP Bridge helps you assess whether 'public' data use is actually exempt — and keep the rest of your processing on a sound footing. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.