Publicly available personal data is a narrower exception than you think

“It was on the internet” is an observation about where information was found. It is not, by itself, a complete DPDP legal analysis. A public professional profile, a leaked customer list and an exposed spreadsheet may all be accessible through a browser, but the circumstances of publication are very different.

The Act’s public-availability exclusion covers personal data made or caused to be made publicly available by the Data Principal, or by another person obliged under Indian law to make it public. As of 22 October 2026, section 3 and the main processing duties are scheduled for May 2027 under the commencement notification.

Ask how the information became public

The first question is who made the data available. Was it the individual concerned? Was another person legally required to publish it? Or was it uploaded by somebody else without clear authority? Keep the evidence behind the answer, not merely the URL where a search engine found it.

The second question is what exactly was made public. An individual might publish a work email address while keeping a mobile number private. A dataset that combines both does not automatically inherit the same treatment for every field. Assess the information being processed rather than applying one label to the entire file.

The third question concerns a claimed legal publication obligation. Identify the Indian law and the particular information it requires to be public. Do not assume that every government-hosted or commercially sold database satisfies this limb without checking the underlying requirement.

Compare three hypothetical sources

A designer places her professional email address on an openly accessible portfolio that she controls. This presents a plausible example for considering the individual-publication limb. The business should still document the source and avoid turning that conclusion into a claim that all conceivable later uses are lawful under every other regime.

A sales agency offers a list of 50,000 phone numbers and says it collected them “from public sources”. That statement does not establish who published each number or whether the statutory conditions hold. Ask for provenance and assess a sample. If the supplier cannot explain the origin, do not treat its assurance as a substitute for evidence.

A search result exposes an apartment association’s spreadsheet containing residents’ contacts. The spreadsheet may have been shared accidentally. Accessibility does not prove the residents themselves made the information public or that a law required publication. Stop and investigate instead of importing it into a campaign.

Public-source work still needs discipline

Create a short source record: URL or document, access date, fields collected, publisher, reason for considering the exclusion, and any limitation. A screenshot can help establish context, but it should not become an unnecessary archive of unrelated personal details.

Where collection combines public and non-public information, keep the provenance at field or source level where feasible. A single “public data” flag can become misleading once staff add purchase history, support notes or inferred preferences. The resulting dataset may require a different assessment from its initial component.

Also separate a legal-scope decision from an ethical or commercial judgement. Repeated unsolicited contact can undermine trust even where a particular DPDP exclusion is relevant. Telecom marketing, contract, confidentiality and other applicable rules need their own checks. This article does not establish that public contact details may be used for any campaign.

Do not turn uncertainty into an invented ban

The opposite mistake is claiming that all collection from public websites necessarily violates DPDP. The statute expressly contains an exclusion. A useful assessment acknowledges it and asks whether the evidence supports its conditions for the activity in question.

Likewise, whether information is behind a login, copied to another site or later removed can raise contextual questions. The Act’s short wording should not be expanded into confident universal rules about every platform setting. Escalate important uncertainty rather than manufacturing certainty in either direction.

A practical purchasing decision

Before buying a contact list, require the supplier to describe collection sources and publication circumstances, permitted uses, update procedures and handling of objections. Compare the answers with a genuine business need for the information. These are diligence questions, not proof of an automatic legal safe harbour.

If provenance remains unclear, the business can choose a more reliable way to build the relationship, such as inviting people to provide their details for a stated purpose. The operational lesson is precise: public access is a starting fact, while the statutory exclusion depends on how the relevant personal data became public.