Does the DPDP Act apply to companies outside India?
Yes, in defined circumstances. The DPDP Act applies to processing of digital personal data outside India where that processing relates to offering goods or services to Data Principals within India. Incorporation abroad and hosting data abroad do not put a business outside the Act if it is serving customers in India.
This is the provision overseas companies most often miss, because it does not depend on having an Indian entity, an Indian office or Indian infrastructure. Selling to Indian consumers is the trigger.
For a foreign company the practical questions are the same as for a domestic one: what personal data of Indian residents do you hold, on what basis, who receives it, and how would an Indian Data Principal exercise their rights with you.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Jupinder Bedi — Jupinder writes on data protection practice at ProtectComply, with a focus on how obligations translate into system behaviour.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →