Does the DPDP Act apply to companies outside India?

A SaaS company in Singapore sells subscriptions to Indian startups. A US app has two million users in India. A Bengaluru BPO processes health claims for American insurers. Which of them must follow the DPDP Act?

Inside India: always covered

Section 3(a) applies the Act to processing of digital personal data within the territory of India, whatever the nationality of the people or the company. Processing in an Indian data centre or by a team sitting in India is covered.

Outside India: covered if you target India

Section 3(b) extends the Act to processing outside India if it is “in connection with any activity related to offering of goods or services to Data Principals within the territory of India.”

So the Singapore SaaS company and the US app are both covered for their Indian users. Signs that you are offering goods or services in India include:

• Prices in rupees, or Indian payment methods such as UPI
• An Indian-language interface or India-specific marketing
• Delivery to Indian addresses
• An India-specific app store listing or website

Note what’s missing: unlike the GDPR, the Act does not separately cover foreign companies that merely monitor the behaviour of people in India without offering them anything. If you’re in this grey zone, take advice.

The outsourcing exemption

Section 17(1)(d) exempts processing of personal data of people not within India, done in India under a contract with a person outside India. That’s the Bengaluru BPO handling American claims. Most of the Act’s obligations don’t apply to that processing, though security still matters commercially and under contract.

The exemption covers foreign data processed in India under a foreign contract. It does not cover Indian residents’ data.

Practical consequences for foreign companies

• Notice and consent must meet the DPDP standard for Indian users.
• Breach reporting to the Data Protection Board applies to breaches affecting Indian users.
• Grievance contact: you must publish the business contact details of a person who can answer questions about processing.
• Penalties can be imposed by the Board, and section 37 lets the Government block public access to a platform after repeated penalties.
• Children’s data: your age gates and parental consent flows need an Indian setting, with 18 as the age of majority.

What about transfers out of India?

Sending Indian users’ data abroad is allowed by default. Section 16 lets the Government restrict transfers to countries it notifies (a “negative list”). No such list had been notified at the time of writing.

Go deeper

Our courses cover applicability, cross-border transfers and outsourcing in depth. Browse the courses.

This article is for education and is not legal advice.