Is Web Scraping Legal in India? IT Act, DPDP Act and Copyright (2026)

Web scraping is legal in India when you access only publicly available pages, do not breach terms you have agreed to, do not copy creative content beyond fair dealing, and handle personal data within the Digital Personal Data Protection Act 2023. India has no scraping-specific law and no reported judgment that treats scraping public data as unlawful in itself. The risk is concentrated in the Information Technology Act 2000, which penalises unauthorised access, and in contract.

This guide covers the four statutes that matter and how Indian courts have approached data, compilations and electronic contracts. General information current as of October 2026, not legal advice. The multi-country overview is Is Web Scraping Legal? What the Law Actually Says.

Which Indian laws govern web scraping?

How does the IT Act treat web scraping?

Section 43 lists acts done “without permission of the owner or any other person who is in charge of a computer”: accessing it, downloading or extracting data, introducing contaminants, causing damage, and disrupting service. Each gives the owner a civil claim for compensation before an adjudicating officer. The statute does not say whether putting a page on the public web constitutes permission to read it, and no reported Indian judgment has squarely decided a public-data scraping case. Three practical conclusions follow:

• Public pages, polite rate: lowest exposure. The owner has invited access by publishing, and there is no damage or disruption.
• Behind a login, or after a block: clearly within Section 43. Using credentials that are not yours, or rotating IPs to defeat a targeted block, is the kind of unauthorised access the section was written for.
• Disruption: Section 43(f) covers denying or disrupting access to authorised users. An aggressive scraper that degrades a site can be liable regardless of whether the data was public.

Section 66 adds criminal liability where a Section 43 act is done dishonestly or fraudulently. Scraping public facts for market research is neither; scraping with stolen credentials is both.

Can I scrape personal data in India?

The DPDP Act 2023 is India’s first comprehensive data protection law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. Processing requires either consent or one of the listed legitimate uses in Section 7, which do not include a general commercial interest comparable to the GDPR’s legitimate interests basis.

The exemption that matters for scrapers is Section 3(c)(ii): the Act does not apply to personal data that the data principal has made publicly available themselves, or that any other person is legally obliged to make public. A professional who publishes their own profile on a networking site has made that data public; a news article naming them has not. The exemption is narrower than it sounds in practice, because scraped datasets rarely distinguish self-published from third-party data, and because data behind a login is not public. Treat personal data as regulated unless you can show it was self-published, collect only the fields you need, and keep a retention schedule. The DPDP Rules were notified in late 2025 with a phased commencement, so verify the current status of the Data Protection Board and notice obligations before relying on any exemption.

Copyright, databases and fair dealing

Indian copyright protects compilations and computer databases as literary works, but the Supreme Court in Eastern Book Company v. D.B. Modak(2008) rejected the pure “sweat of the brow” standard and required a minimum degree of creativity in selection or arrangement. A list of prices or product specifications ordered by date has none; an editorially curated directory may. India has no sui generis database right of the EU kind and no text-and-data-mining exception. Fair dealing under Section 52 covers private use, research, criticism and review, and news reporting, and Indian courts have read “research” narrowly for commercial actors. The safe pattern is the same as elsewhere: extract facts and fields, analyse rather than reproduce, and never republish creative text or images.

Terms of service and electronic contracts

Section 10A of the IT Act confirms that contracts formed electronically are enforceable, and Indian courts treat clickwrap terms as binding under the Indian Contract Act 1872 when the user had notice and indicated assent. Browsewrap terms that a visitor never saw are harder to enforce, as in other common-law jurisdictions. Because India lacks a scraping-specific judgment, contract is the most predictable claim an operator can bring: if you registered an account, the anti-scraping clause binds you, and continuing after a written demand to stop converts a weak case into a strong one.

Checklist for scraping Indian websites

1. Scrape only logged-out, public pages. Do not use accounts or bypass blocks; Section 43 is built for that conduct.
2. Keep request rates low enough that disruption under Section 43(f) cannot be argued.
3. Do not accept terms on behalf of the scraping entity; if you have, honour the anti-scraping clause.
4. Extract facts and fields; do not reproduce creative text, images, or curated arrangements.
5. Treat personal data as DPDP-regulated unless it was self-published by the individual; minimise fields and set retention limits.
6. Stop on a legal notice and take advice. India’s adjudicating-officer route under the IT Act is faster than civil litigation.

The engineering side is covered in Web Scraping Best Practices.