DPDP Act 2023 and Web Scraping in India: Compliance Guide

The Digital Personal Data Protection (DPDP) Act, 2023 came into effect in India in 2026, fundamentally changing the legal landscape for web scraping and data collection. If you scrape Indian websites or use Indian proxies, understanding DPDP compliance is no longer optional.

What the DPDP Act Covers

The DPDP Act regulates the processing of digital personal data. Key provisions affecting web scrapers:

1. Consent requirement: Personal data processing requires explicit consent
2. Purpose limitation: Data can only be used for the specified purpose
3. Data minimization: Only collect what is necessary
4. Cross-border transfers: Restrictions on processing Indian personal data outside India
5. Penalties: Fines up to 250 crore rupees for violations

Is Web Scraping Illegal Under DPDP?

Not necessarily. The DPDP Act focuses on personal data. Web scraping is compliant if:

• You only collect publicly available non-personal data (product prices, business listings, news articles)
• You do not scrape personal information (names, contact details, Aadhaar, financial data)
• You have a legitimate purpose that does not require individual consent
• You implement data retention and deletion policies

Using Proxies and the DPDP Act

Proxies do not exempt you from DPDP compliance. Using Indian mobile proxies does not change the legal status of the data you collect.

Key considerations:

1. Data localization: Consider where collected data is stored
2. Data fiduciary obligations: If you collect Indian personal data at scale, you may qualify as a Significant Data Fiduciary
3. Cross-border impact: Indian IPs collecting data from Indian sites means DPDP jurisdiction applies

Best Practices for Compliant Scraping

1. Only scrape publicly available non-personal data
2. Avoid scraping personal information
3. Respect robots.txt and website Terms of Service
4. Implement reasonable rate limiting
5. Delete data when no longer needed
6. Document your data collection practices

FAQ

Does the DPDP Act make web scraping illegal in India? No. The DPDP Act regulates personal data processing. Scraping publicly available non-personal data is legal. Scraping personal data without consent is prohibited.

Are Indian proxy users affected by DPDP? If you are scraping Indian websites or data about Indian individuals, the DPDP Act applies regardless of where you are located.

What are the penalties for violating DPDP? Penalties can reach up to 250 crore rupees for severe violations. The Data Protection Board of India has enforcement authority.

Do I need consent to scrape business listings? Business listings that are publicly available (company names, addresses, phone numbers published on websites) are generally not considered personal data under DPDP. However, scraping private contact information or individual details requires consent.