Pandectes Outlines DPDP Act Compliance and Extraterritorial Rules for Data Fiduciaries

What happened

Pandectes published a regulatory compliance overview detailing the requirements of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The document defines the basic scope of the legislation. It details how businesses, operating as Data Fiduciaries, process the digital personal data of individuals classified as Data Principals. The Digital Personal Data Protection Rules, 2025 introduce practical compliance mandates for these entities. A key section specifies the exact information a consent notice requires. The rules also define procedural expectations for companies responding to data requests from users.

Does the DPDP Act apply here

Section 3 of the DPDP Act dictates the territorial scope of the legislation. The law governs digital personal data processed within India, including data collected digitally or digitized subsequently. The Act enforces strict extraterritorial applicability for entities located outside the country. Foreign processing falls under the law if the activity involves offering goods or services to Data Principals within India. The Pandectes guide uses a specific example to clarify this boundary. A foreign-based online store selling items to customers in India operates directly under this statutory mandate.

Legal implications under DPDP

Section 4 establishes the lawful purpose for processing personal data. Consent operates as the primary basis for data operations, except where Section 7 legitimate uses apply. Businesses cannot process data for purposes expressly forbidden by law. The DPDP Rules define the mechanics for obtaining this permission. A Data Fiduciary provides a clear notice detailing the data collected and the specific purpose for the processing activity. The framework grants individuals control over their digital information. Data Principals hold the right to request access to their data and demand the correction of inaccurate details. They also possess the right to require the erasure of their personal information, and the Rules mandate specific procedures for organizations handling these incoming requests.

Enforcement and regulatory oversight

The Data Protection Board of India manages regulatory enforcement across the digital economy. This entity operates as the primary oversight authority for the Act. The Board holds the power to inquire into legal breaches and evaluate complaints filed by Data Principals against companies failing to meet their obligations. It possesses the statutory authority to levy financial penalties on non-compliant businesses. The maximum penalty amounts are formally set within a schedule attached to the Act, meaning a company failing to maintain required consent records faces direct exposure to these scheduled fines.

What companies should do in the next 30 days

1. The legal team audits all current data collection forms against the consent notice requirements in the Rules.

2. Compliance officers verify whether offshore systems offer goods or services to individuals in India to confirm territorial scope.

3. Product managers test the internal procedures used for responding to data access and erasure requests.

4. IT departments configure systems to capture and store valid consent records for presentation during a Board inquiry.

5. Executives evaluate the penalty schedule to quantify the financial risk of non-compliance across their digital operations.

What to watch

The Data Protection Board is establishing its procedural framework for investigating compliance failures. Foreign companies operating online stores face immediate scrutiny regarding their data practices for customers located in India. Legal teams have a defined window to adjust their consent architectures. They update internal systems to meet the published rules. The Central Government retains the power to appoint different commencement dates for specific provisions of the Act. Companies operating across borders track these official gazette notifications to confirm their compliance deadlines.