Is Web Scraping Legal in India? What a Business Can and Cannot Collect

A small analytics company collects publicly listed prices from a competitor's website every morning. Six months later a legal notice arrives, alleging unauthorised access to a computer resource, breach of terms of use and infringement of copyright. The founders are genuinely surprised, because nothing they collected was hidden behind a password.

India has no statute dealing specifically with web scraping. That does not mean the activity is unregulated. It means the answer is assembled from four different laws, and which of them applies depends on what was collected, how it was collected, and what happened to it afterwards.

The four laws that decide the question

• The Information Technology Act, 2000. Section 43 makes a person liable to pay compensation for accessing a computer resource, or downloading and copying data from it, without the permission of the owner. Section 66 turns the same conduct into an offence punishable with imprisonment where it is done dishonestly or fraudulently.
• The Copyright Act, 1957. Facts are not protected, but the arrangement and selection in a compilation can be, and reproducing substantial portions of a database can amount to infringement.
• The Indian Contract Act, 1872. Terms of use accepted by a user form a contract, and collecting in breach of those terms is a contractual claim independent of any question under the IT Act.
• The Digital Personal Data Protection Act, 2023. If what is collected includes personal data, the obligations under this Act attach to the collector.
• A claim rarely rests on one of these alone. The usual notice pleads contract and copyright together, with the IT Act as the aggravating layer.

Consult top-rated Civil lawyers in your city

641+ Lawyers are online

FIND MY LAWYER NOW

Publicly visible does not mean free to take

The most common misunderstanding is that anything visible without a login is public property. In Indian law the correct question is different: was there permission, express or implied, and does the material attract protection in its own right.

On copyright, the position was settled by the Supreme Court in Eastern Book Company v. D.B. Modak, which held that a work must show at least a minimum degree of creativity to be protected, rejecting the older view that labour alone was enough. A list of raw prices or phone numbers will usually fail that test. A curated directory with original descriptions, editorial selection and structure may well pass it, and copying it wholesale carries real risk.
 

Terms of use are where most disputes actually start

Almost every commercial website prohibits automated access somewhere in its terms. Whether those terms bind a particular collector depends on how they were presented. Terms accepted by clicking during registration are on much firmer ground than terms sitting behind a link in a footer that nobody was required to open.

This produces a practical rule with few exceptions. Once a business creates an account on a site, it has almost certainly accepted the terms of that site, and any collection through or after that account becomes a contractual issue. Collecting pages that never required an account is a materially weaker case for the website owner.
 

How the collection is carried out affects the analysis

Courts and regulators look at conduct, not only at outcome. Two businesses collecting identical data can be in very different positions depending on method.

Requests sent at a modest rate, identifying themselves honestly and respecting the instructions a website publishes for automated visitors, look like ordinary commercial research. The same collection carried out at a volume that degrades the site's performance engages Section 43 of the IT Act, which covers disruption as well as copying, and it supplies the other side with evidence of intent.

The routing is a related point. Businesses commonly send this traffic through datacenter proxies , which are server based addresses used to distribute requests and to see a site as a visitor in another region would. Providers such as ProxyWing supply them for price monitoring, advertising verification and similar work, and using them is not by itself unlawful. What changes the picture is purpose. Distributing requests to keep load low, or to check what customers in another state actually see, is ordinary practice. Rotating addresses specifically to defeat a block the website owner has already imposed is conduct a court can read as knowledge that permission was absent, which is exactly the element a Section 66 allegation needs.
 

Consult top-rated Civil lawyers in your city

641+ Lawyers are online

FIND MY LAWYER NOW

Personal data changes everything

If names, contact details or any other information relating to identifiable individuals are collected, the Digital Personal Data Protection Act, 2023 applies to the collector as a data fiduciary. The Act carves out personal data that the individual has themselves made publicly available, which covers a good deal of what appears on social profiles, but the exemption is narrower than it first appears and does not extend to building profiles from combined sources.

For most businesses the safe course is to avoid collecting personal data at all unless it is essential, and to document that decision. Price lists, product specifications and stock availability raise no issue under this Act. Scraped contact databases for cold outreach raise several, and they are also the fact pattern most likely to generate a complaint.
 

Practical rules for a business collecting public data

• Do not create an account, or use someone else's, to reach material that would otherwise require one. This converts a weak claim into a strong one.
• Respect the robots file and any published access policy. It is not a statute, but ignoring it is used to show that permission was refused.
• Keep request volumes low enough that they cannot be characterised as disruption.
• Stop on receiving a specific request to stop. Continuing after notice removes any argument that access was implicitly permitted.
• Do not reproduce the collected material as your own product. Using data to inform a decision is very different from republishing a competitor's compilation.
• Keep records of what was collected, when, and from where. If a dispute arises, the absence of records is treated as a fact against you.

If a legal notice arrives

Do not respond by continuing the collection while negotiating. Pause it, preserve the logs rather than deleting them, and take advice before replying. Notices of this kind are frequently drafted broadly in the hope of a quick undertaking, and the claims asserted are often wider than what the facts support. A measured reply, sent within the time given, resolves most of these matters without proceedings.

This article sets out general information on the law as it stands and is not a substitute for advice on your specific facts. Anyone facing a notice, or planning a data collection programme of any scale, should consult a lawyer practising in technology and intellectual property law.
 

FAQ

Is scraping a public website a criminal offence in India?
Not by itself. Section 43 of the IT Act creates civil liability for access without permission. It becomes an offence under Section 66 only where the act is done dishonestly or fraudulently, which requires proof of intent.

Can a website stop me from collecting data it publishes freely?
It can impose terms of use, block access and send notice. Once notice is given, continued collection is much harder to defend, whatever the position was before.

Are prices and product details protected by copyright?
Individual facts are not. A compilation may be protected if it shows a minimum degree of creativity in selection or arrangement, following the standard laid down in Eastern Book Company v. D.B. Modak.

Does the DPDP Act apply if I only collect business information?
It applies to personal data relating to identifiable individuals. Company level information such as prices, addresses of premises and product catalogues falls outside it, but a named contact person within that data does not.

What if the website is hosted outside India?
Indian law can still apply where the effect is felt in India, and the foreign website's own jurisdiction may apply as well. Cross border collection needs advice before it starts, not after a notice arrives.

Advocate Chikirsha Mohanty

Greater Kailash - 1, Delhi
5 years

GET LEGAL HELP

GET LEGAL HELP