Does the DPDP Act apply to foreign companies?

The Digital Personal Data Protection Act, 2023 applies directly to foreign companies.

Under Section 3(b), the law covers the processing of digital personal data outside India. This applies when the processing connects to offering goods or services to Data Principals within the territory of India. The statute focuses on the target audience rather than server locations. A company based in Singapore or the United States falls under the Act if it offers digital subscriptions or ships physical products to users in India. Exactly 192 days remain until the DPDP compliance deadline of 13 May 2027. Foreign entities apply new data collection workflows to meet this timeline.

Beyond Physical Presence

Companies trigger the Act without a registered office, local servers, or employees in India. A go-to-market strategy targeting Data Principals in India through localized pricing or direct service delivery brings operations into scope. Selling a software tier priced in Indian Rupees establishes this connection. Shipping physical goods to local addresses does the same. Large enterprise buyers in India now treat DPDP compliance as a procurement gate. Vendors undergo strict risk assessments during the sales cycle. To pass these reviews, providers set up clear documentation of their data practices.

Exemptions Under Section 3(c)

Section 3(c) outlines specific boundaries for this extraterritorial reach. The law excludes personal data processed by an individual for personal or domestic purposes. It also exempts personal data made publicly available by the Data Principal to whom it relates. If a user publishes their own contact details on an open forum, a foreign company collecting that data does not require consent under the Act. A legal obligation that causes data to become public triggers the same exemption. Organizations still verify the source of public data before adding it to their systems.

Cross-Border Data Transfers Under Section 16

Foreign companies often ask if they need local data storage inside India. They do not. Section 16 permits cross-border data transfers by default. The Central Government holds the power to restrict transfers to notified countries or territories. This creates a negative list approach for international data flows. Organizations continue processing data in their existing foreign cloud infrastructure unless their host country lands on the restricted list. Section 16(2) preserves the applicability of any other Indian law providing a higher degree of restriction. Sector-specific regulators like the Reserve Bank of India maintain separate localization mandates for payment data.

Lawful Purpose and Section 4

Processors establish a valid legal basis to handle data from India. Section 4 dictates that a person processes personal data only for a lawful purpose. The statute defines lawful purpose as any purpose not expressly forbidden by law. The consent of the Data Principal forms the primary basis. Section 7 permits processing without consent for certain legitimate uses. These legitimate uses include medical emergencies, employment purposes, and state functions. Companies evaluate every data flow to determine whether to ask for consent or apply a legitimate use.

Why Your Existing Setup Falls Short

Non-Indian founders often assume their European compliance setups cover Indian requirements automatically. The laws contain structural differences. The DPDP Rules, 2025 introduce specific operational mechanics. Fiduciaries present an itemised notice before collecting consent. This notice specifies the data collected and the purpose of processing. The Rules mandate offering this notice in English and the 22 languages listed in the Eighth Schedule of the Indian Constitution. Platforms also set up verifiable parental consent mechanics for users under 18. These requirements differ from European age-gating workflows. Companies build distinct consent modules to address these rules.

Breach Reporting Timelines

Incident response teams update their playbooks for users in India. The Rules, 2025 establish a tight window for security incidents. A Data Fiduciary submits a detailed breach report to the Data Protection Board within 72 hours. Organizations also send an intimation to the affected Data Principals without delay. The notification to the Board includes the nature of the breach, the number of affected users, and the remedial steps taken. Relying on outside counsel to draft these notices after a breach occurs often delays the filing past 72 hours. Teams prepare pre-approved templates ready to deploy.

Enforcement Reach and Blocking Orders

Ignoring these obligations carries severe financial and operational risks. The Data Protection Board levies penalties reaching 250 crore rupees for failing to secure personal data. Foreign companies face an additional threat to their market access. If a foreign entity repeatedly violates the Act, the Central Government holds the power to block public access to its platform or service within India. Internet Service Providers execute these blocking orders locally. This action cuts off market access entirely.

Grievance Redressal and Withdrawal

Foreign data fiduciaries set up clear communication channels for Data Principals. The law requires a readily available mechanism for users to withdraw their consent. The withdrawal process functions as easily as the consent mechanism. Companies publish the contact details of a Data Protection Officer or a designated grievance officer. Users hold the right to nominate another individual to act on their behalf in the event of death or incapacity. Internal systems process these requests within the timelines specified in the Rules.

What To Do Next

1. Map the data collected from Data Principals in India to determine if Section 7 legitimate uses apply or if consent is required.

2. Update the frontend infrastructure to issue the itemised notices required by the Rules, 2025.

3. Apply language selection toggles to support the Eighth Schedule languages for consent notices.

4. Revise incident response playbooks to guarantee a 72-hour reporting capability to the Data Protection Board.

5. Build an accessible portal for Data Principals to withdraw consent and file grievances.

To evaluate exact gaps without retaining local counsel, run a free compliance scan at https://www.complydp.com/audit-preview.