KV TechLegal
Back to insights

Data protection and privacy

Same Post, Different Countries: Who Protects Your Public Data After You Hit “Share”?

Written by Hirendhar Lakshmanan, Partner and Nikitha Vaitheeswaran, Partner. 2026-10-16. 10 min read.

Suppose you leave a public Google review of a restaurant, keep a LinkedIn profile that lists your employer, and post on Instagram about volunteering at your temple's annual festival. A data broker collects all three, links them to a phone number taken from an online business directory, and sells the resulting profile to lenders, recruiters and marketers.

You chose to publish each of those pieces, so it is natural to assume that anyone may now do as they please with them. India's new data protection law largely shares that assumption. Most other major data protection laws do not, and the reasons they give say a good deal about what privacy is meant to protect once information has already left our hands.

India: once public, outside the law

The Digital Personal Data Protection Act, 2023 (DPDP Act) does not apply to personal data that the person concerned has made, or caused to be made, publicly available. The Act illustrates the point with a person who shares her personal data on social media while blogging her views, and it extends the same treatment to data that someone is legally obliged to publish [1]. The result is not a lighter set of rules but no rules at all: the broker in our example would need no consent or other lawful ground, would owe you no notice, and would not have to erase anything at your request. You could not raise a grievance with the broker or complain to the Data Protection Board, and because the Act has no separate category for sensitive data, the post that reveals your religion would be treated exactly like the profile that reveals your job title.

All of this, however, still lies in the future. The DPDP Rules, 2025, notified on 13 November 2025, bring the Act into force in stages. The Data Protection Board was set up immediately, but the core obligations and rights, including the public-data exclusion itself, take effect only in May 2027 [2]. Until then, people in India must rely on section 43A of the Information Technology Act, 2000 and the 2011 rules made under it, which protect only a short list of sensitive data and also exclude information that is freely available in the public domain [3]. Public data has never been well protected in India; the DPDP Act will simply make that position explicit.

The gaps in India's exclusion

Although the exclusion looks sweeping, it is built around a single act of publication by the person concerned, and real-world data collection rarely fits that pattern. What a relative posts about your religion, or what turns up in a leaked database, remains within the Act, because you did not make it public. A broker gathering data in bulk usually has no way of telling which records fall on which side of that line, and it bears the risk of guessing wrong.

Combining data raises a harder question. You published your review, your LinkedIn profile and your Instagram post in different places and for different reasons, but nobody published the profile that joins them to a phone number. The Act does not say whether such a profile is still excluded, and there is a reasonable argument that it is not, since what the broker sells is something no one ever made public. Deletion is equally unresolved; the exclusion refers to data that “is made or caused to be made publicly available” [1] in the present tense, which suggests that a copy kept after you remove the original may no longer qualify, but the Act does not settle the point.

The rest of Indian law does little to fill these gaps for the individual; the Information Technology Act penalises copying data from a computer resource without its owner's permission [3], and most platforms prohibit scraping in their terms of use, but both protect the platform being scraped rather than the person whose data is taken.

Why protect what is already public?

If India's approach seems intuitive, it is worth asking why most regulators and courts elsewhere have rejected it. Their reasoning rests on four connected ideas.

The first is context. People publish for a purpose and an audience, whether that is a review for other diners, a profile for recruiters or a post for friends, and reusing the information for something else breaks the terms on which it was shared. Brazil has written this idea into its law, which requires anyone processing publicly accessible data to take into account the purpose, good faith and public interest that justified making it available [4].

The second, aggregation, follows from the first. Once scattered pieces are combined, they produce information that nobody chose to publish, such as where you work, what you believe and how to reach you, all in a single record. It is that record, rather than any single post, that makes fraud, profiling and unwanted marketing possible. In 2023, twelve data protection authorities issued a joint statement warning about precisely these harms and reminding companies that publicly accessible personal data remains subject to data protection law in most jurisdictions [5].

The third is control. Posting something is not a once-and-for-all surrender, because people keep changing their privacy settings, deleting posts and closing accounts. When Canada's privacy commissioners investigated Clearview AI, which had scraped billions of facial images from the web, they declined to treat social media content as “publicly available”, partly for this reason [6]. The fourth idea, scale, explains why the Clearview case alarmed regulators in the first place. A person reading your review is one thing; a company harvesting millions of images and running them through automated systems is quite another, and regulators in both Canada and Australia found Clearview's collection unlawful [6][7].

None of these ideas is foreign to Indian law. In Puttaswamy, the Supreme Court recognised informational privacy, including a person's control over the dissemination of information about themselves, as part of the fundamental right to privacy [8]. An exclusion that ends all control the moment something is posted sits uneasily with that reasoning.

The EU: public data is still personal data

The European Union's General Data Protection Regulation (GDPR) starts from the opposite position: data you have posted publicly is still personal data, and almost every ordinary rule continues to apply. A broker needs a lawful basis, usually its legitimate interests, which it can rely on only if your own interests and rights do not override them, and it may use the data only for purposes compatible with those for which it was collected. You, in turn, keep the right to be told that the broker holds your data and where it obtained it, to receive a copy, to object, and to have the data erased once your objection succeeds [9].

In practice, these rights are weaker than they appear. The duty to inform you lapses where doing so would involve disproportionate effort, and bulk collectors routinely rely on that exception [9], so many people never learn that a broker holds their data. A right you do not know you have is of limited use.

Sensitive data receives an additional layer of protection. Because your post about the temple festival reveals your religious beliefs, it falls within a special category of data that the GDPR allows to be processed only under a closed list of exceptions. One of those exceptions covers data that the person has manifestly made public, but it only lifts the ban on processing: the broker still needs a lawful basis, must still respect purpose limitation, and you keep all your rights [9]. The Court of Justice of the EU has also read the exception narrowly. Simply posting or interacting on a platform does not make data manifestly public; the person must have made a deliberate and informed choice to share it with an unlimited audience [10], nor does making one fact public open up everything connected to it. When Max Schrems discussed his sexual orientation on a public panel, the Court held that this did not permit Meta to process other data about his sexual orientation for advertising [11].

The difference between the two systems is therefore one of design rather than degree. India treats public availability as a switch that turns data protection off, whereas the EU treats it as the removal of a single barrier, for a single kind of data, and leaves every other rule in place.

The rest of the world

Most other countries fall somewhere between those two positions, and Canada and Australia sit closest to the EU. Canadian federal law allows publicly available information to be collected without consent only if it comes from sources listed in regulations, such as directories, public registries and published newspapers or books, and generally only for a purpose connected to why it appears there [12]. Social media is not on that list, which is why Clearview needed consent. Australia's Privacy Act goes further, with no general exception for public data at all, and its regulator found that Clearview had collected sensitive biometric data both without consent and by unfair means [7].

Brazil occupies the middle ground. It waives consent for data that the person has manifestly made public, but it keeps the person's rights and the law's principles intact, and it allows reuse for a new purpose only if that purpose is legitimate and specific [4]. California and Singapore are more permissive. California excludes publicly available information from its definition of personal information, although it does not treat biometric data collected without the consumer's knowledge as publicly available [13]. Singapore allows publicly available data to be used without consent but still requires the purpose to be one that a reasonable person would consider appropriate [14].

India, then, is not an outlier, but its approach is among the broadest. Brazil and Singapore remove only the requirement for consent, whereas India, like California, places self-published data outside the law entirely, along with every right that would otherwise come with it.

AI training: the next test

The question is becoming more pressing as public posts are gathered at scale to train AI models, a practice that engages context, aggregation, control and scale all at once. In the EU, AI developers need a lawful basis like anyone else. The European Data Protection Board has accepted that legitimate interests may suffice, but only after a case-by-case balancing test that considers, among other things, whether people could reasonably expect their data to be used for training and whether it was obtained by scraping [15]. The EU AI Act leaves data protection law untouched and requires providers of general-purpose AI models to publish a summary of the content used to train them [16]. The European Commission has proposed amending the GDPR to make AI training easier to justify, but at the time of writing those changes have not been adopted [17].

In India, once the Act takes effect, training on data that people posted about themselves will fall outside it. Data that others posted, and leaked data, will fall within it, but the Act also exempts processing for research, archiving or statistical purposes, provided the data is not used to take decisions about specific individuals [1]. Whether commercial AI training counts as research has not yet been tested. If it does, very little scraped data would remain within the Act's reach.

Back to the profile

Return, finally, to the broker and the profile it has built from your review, your LinkedIn page and your festival post. In the EU, the broker would need a lawful basis to build that profile and a stronger justification for the part that reveals your religion, and you could object and have the data erased, provided you discovered that the broker existed. In Canada and Australia, regulators have already found that scraping social media without consent breaks the law. In India, once the DPDP Act is in force, the pieces you posted yourself will sit outside it, and the Act will not tell you whether the profile that combines them does too.

Under the DPDP Act, then, posting something publicly comes close to giving up any say over what happens to it next. Most other data protection laws reject that outcome, because information shared for one purpose can be collected, combined and reused for very different ones. Whether India should follow them, particularly now that AI developers collect public posts at scale, is a decision for Indian lawmakers, and the time before the Act takes effect in May 2027 is the natural moment to make it.

References

  1. Digital Personal Data Protection Act, 2023 (No. 22 of 2023), ss. 2(t), 3(c)(ii) and the illustration to s. 3, 4–7, 12, 13, 17(2)(b) and 27.
  2. Digital Personal Data Protection Rules, 2025, rule 1, and Ministry of Electronics and Information Technology notification under s. 1(2) of the Act, both of 13 November 2025.
  3. Information Technology Act, 2000, ss. 43(b), 43A and 66; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, rule 3.
  4. Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, Brazil), Art. 7, §§ 3, 4 and 7.
  5. Joint statement on data scraping and the protection of privacy, 24 August 2023, issued by twelve data protection authorities including those of the UK, Canada and Australia.
  6. Office of the Privacy Commissioner of Canada and others, Joint investigation of Clearview AI, Inc., PIPEDA Findings #2021-001, 2 February 2021.
  7. Commissioner initiated investigation into Clearview AI, Inc. (Privacy) [2021] AICmr 54.
  8. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
  9. Regulation (EU) 2016/679 (General Data Protection Regulation), Arts. 4(1), 5(1)(b), 6(1)(f), 6(4), 9, 14, 15, 17 and 21.
  10. Case C-252/21 Meta Platforms and Others v Bundeskartellamt, judgment of 4 July 2023.
  11. Case C-446/21 Schrems v Meta Platforms Ireland, judgment of 4 October 2024.
  12. Personal Information Protection and Electronic Documents Act (Canada), s. 7; Regulations Specifying Publicly Available Information, SOR/2001-7.
  13. California Civil Code, § 1798.140(v)(2).
  14. Personal Data Protection Act 2012 (Singapore), ss. 17 and 18 and the First Schedule.
  15. European Data Protection Board, Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, 17 December 2024.
  16. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Arts. 2(7) and 53(1)(d).
  17. European Commission, Digital Omnibus proposal, 19 November 2025.

Topics

This note is a general account of the law at the date shown. It is not legal advice.