1Does the DPDP Act apply to your foreign company?

---

The DPDP Act applies to the processing of digital personal data, meaning data about an identifiable individual collected in digital form, or collected offline and later digitised. Its territorial reach has two limbs:

1. Processing within India, whoever the data fiduciary is and wherever the individuals are located; and
2. Processing outside India, if it is in connection with any activity related to offering goods or services to data principals within India (Section 3(b)).

A foreign company does not need an Indian entity, office or server to be covered. A US software provider selling subscriptions to Indian customers, a European e-commerce site shipping to India, or a Singapore travel platform taking bookings from Indian users can all fall within scope.

1.1 Common situations for foreign groups

2Fiduciary, processor or significant data fiduciary?

---

The Act uses its own vocabulary. Getting your role right determines which obligations apply.

A key principle runs through the Act: the data fiduciary is responsible for compliance irrespective of any agreement to the contrary, including for processing carried out by its processors. Outsourcing processing does not outsource liability.

3The three phases of the DPDP Rules

---

The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)) and come into force in three stages. The relevant provisions of the Act are brought into force alongside them.

• Phase 1 — 13 Nov 2025
  Institutional set-up. Definitions and the rules on the Data Protection Board, its composition, the appointment of its members and its functioning as a digital office came into force. In 2026 the Government began the process of appointing the Chairperson and members. No processing obligations applied to businesses in this phase.
• Phase 2 — 13 Nov 2026
  Consent managers. Rule 4 and the First Schedule apply. Indian companies meeting the eligibility conditions, including a minimum net worth of ₹2 crore, can register with the Board as consent managers and become subject to its oversight.
• Phase 3 — 13 May 2027
  Core obligations. Rules 3 and 5 to 16, 22 and 23 apply: notice, security safeguards, breach intimation, retention and erasure, contact details, children and persons with disabilities, exemptions, significant data fiduciary duties, data principal rights, cross-border transfers, research and the power to call for information. Section 43A of the Information Technology Act, 2000 and its rules on sensitive personal data are replaced.

4What applies from 13 May 2027

---

4.1 Lawful grounds: consent or legitimate uses

Personal data may be processed only for a lawful purpose with the individual's consent, or for certain legitimate uses specified in the Act. Legitimate uses are narrower than the GDPR's "legitimate interests". They include data voluntarily provided for a specified purpose without objection, employment purposes, compliance with law or court orders, medical emergencies and certain state functions. Most commercial processing, including marketing and analytics, will rely on consent.

4.2 Consent requirements

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the specified purpose. It must be as easy to withdraw as to give. Pre-ticked boxes, bundled consents and consent buried in terms and conditions will not work.

4.3 Notice requirements (Rule 3)

Every request for consent must be accompanied by, or preceded by, a notice that is:

• presented independently of other information, and understandable on its own;
• in clear and plain language, with an option to read it in English or any language in the Eighth Schedule to the Constitution;
• itemised, listing the personal data and the specific purpose and description of the goods or services enabled by the processing;
• accompanied by a communication link or other means to withdraw consent as easily as it was given, to exercise rights, and to complain to the Data Protection Board.

For data collected before the Act's commencement on the basis of consent, a notice must be given as soon as reasonably practicable.

4.4 Reasonable security safeguards (Rule 6)

Every fiduciary must protect personal data with reasonable security safeguards, including at minimum:

• encryption, obfuscation, masking or virtual tokens;
• access controls over the computer resources used;
• visibility through logs, monitoring and review to detect unauthorised access;
• measures for continued processing after a compromise, including backups;
• retention of logs and data for detection and investigation, for at least one year; and
• appropriate provisions in contracts with processors requiring them to take these safeguards.

4.5 Accuracy, purpose limitation and contact point

Fiduciaries must ensure accuracy and completeness where data is used to make decisions or is shared with another fiduciary, must erase data once the purpose is served (subject to legal retention), and must prominently publish the business contact details of a person who can answer questions about processing, or of the Data Protection Officer where one is required.

5Personal data breaches: the 72-hour rule

---

Unlike the GDPR, the DPDP framework requires reporting of every personal data breach, with no materiality threshold. Under Rule 7:

1. Inform affected individuals without delay. In a concise, clear and plain manner, describe the breach, its likely consequences, the mitigation measures taken, safety measures they can take, and contact details for queries.
2. Inform the Data Protection Board without delay. Give an initial description, including nature, extent, timing, location and likely impact.
3. Send a detailed report within 72 hours. Cover updated facts, circumstances and reasons, mitigation, the findings on the person responsible, remedial measures and reports given to individuals. The Board may allow more time on a written request.

6Data principal rights and grievances

---

Individuals have the right to:

• access a summary of their data, the processing activities and the identities of other fiduciaries and processors with whom it has been shared;
• correction, completion, updating and erasure of their data;
• grievance redressal, which must be exhausted before approaching the Board; and
• nominate another person to exercise their rights in case of death or incapacity.

Fiduciaries must publish on their website or app the means by which individuals can make requests, and the identifiers they may need to provide. Grievances must be answered within a reasonable period, not exceeding 90 days under the Rules. Foreign companies should consider whether their global data subject request tools meet these Indian requirements and timelines, and whether they support nomination.

7Retention, erasure and logs

---

The Act requires erasure once the purpose is no longer served. The Rules give specific retention periods for large platforms in the Third Schedule:

Data retention also needs to be reconciled with other Indian laws, such as the Companies Act, tax laws, labour laws and sectoral rules, which require some records to be kept for eight years or more.

8Children's data

---

A "child" under the DPDP Act is anyone below 18 years, a higher age than most other privacy laws. Before processing a child's data, a fiduciary must obtain verifiable consent of a parent or lawful guardian (Rule 10), using reliable identity and age details already available or a virtual token issued by an authorised entity, such as a government-linked digital locker service. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited.

The Rules exempt certain classes of fiduciaries and purposes from some of these restrictions, such as clinical establishments, educational institutions, childcare providers and the protection of children's safety. Foreign edtech, gaming, social media and consumer platforms with Indian users under 18 will need to redesign onboarding and age-assurance flows.

9Significant data fiduciaries

---

The Government can notify any fiduciary or class of fiduciaries as a significant data fiduciary (SDF). Large global platforms, financial services providers and companies handling sensitive data at scale should assume they may be designated. SDFs must:

• appoint a Data Protection Officer based in India, who represents the SDF and reports to its board;
• appoint an independent data auditor;
• carry out a data protection impact assessment and audit every 12 months and report significant findings to the Board;
• conduct due diligence on algorithmic software to verify that it does not pose a risk to individuals' rights; and
• ensure that personal data specified by the Government on the recommendation of a committee, and related traffic data, is not transferred outside India.

For a foreign company designated as an SDF, the India-based DPO requirement effectively creates a local presence obligation. Groups with an Indian subsidiary can often place this role there; others may need to establish one. See our pages on wholly-owned subsidiaries and liaison offices.

10Cross-border transfers

---

The DPDP Act takes a permissive approach to international transfers. Section 16 allows transfers to any country unless the Government restricts transfers to a particular country by notification, a "negative list" model. No country has been notified so far.

Rule 15 adds that transfers by a fiduciary processing data in India, or in connection with offering goods or services to people in India, are subject to requirements the Government may specify by general or special order regarding making that data available to a foreign state or its agencies. In addition:

• stricter sectoral localisation rules prevail, for example RBI rules requiring payment system data to be stored in India;
• SDFs may be required to keep specified data in India; and
• there is no requirement for standard contractual clauses or adequacy decisions, unlike the GDPR.

For most foreign groups, intra-group transfers of Indian customer and employee data can continue, but they should be documented, secured and covered by contracts, and monitored for any future Government orders.

11DPDP vs GDPR: what a GDPR programme does not cover

---

Many foreign companies assume their GDPR compliance will carry them through. It helps, but there are important differences.

12Penalties and enforcement

---

The Schedule to the DPDP Act sets maximum penalties per instance of breach. The Board decides the actual amount based on the nature, gravity and duration of the breach, the type of data, repetition, any gain or loss avoided, mitigation and proportionality.

The Board can also accept voluntary undertakings, and on its reference the Government can, in certain cases of repeated breaches, direct that public access to a fiduciary's platform in India be blocked. Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal.

13Your month-by-month roadmap to May 2027

---

Seven months is not long for a programme that touches product design, IT, HR, legal, marketing and vendors. A realistic plan for a foreign company with Indian users or an Indian subsidiary:

14Contracts with Indian subsidiaries, vendors and clients

---

Because the fiduciary remains responsible for its processors, contracts are a central compliance tool. Foreign groups should review:

• Intra-group data agreements between the Indian subsidiary and the parent or shared service centres, setting out roles, purposes, security, breach notification and assistance with rights requests.
• Processor agreements with cloud, HR, payroll, CRM, marketing and analytics vendors, including Rule 6 safeguards, breach notice to the fiduciary, deletion on termination, audit rights and sub-processor controls. Our vendor compliance service can help.
• Customer and platform terms, privacy notices and cookie or tracking disclosures for Indian users.
• Technology and SaaS contracts where the foreign company acts as a processor for Indian business customers; these customers will ask for DPDP clauses. See technology licensing agreements and software and digital content protection.
• Employment documents for Indian staff, including employee privacy notices and policies; payroll data handling should align with our payroll processing standards.
• M&A and investment documents, adding DPDP representations, warranties and due diligence on data practices.

15How Delhi Legal Company can help

---

Delhi Legal Company helps foreign companies and their Indian subsidiaries prepare for the DPDP framework, alongside the corporate, tax and regulatory compliance they already manage in India.

16Conclusion

---

India's data protection regime is no longer a future concern. The institutional framework is in place, consent managers arrive in November 2026, and the obligations that matter most to businesses apply from 13 May 2027. Its reach is deliberately broad: any foreign company that offers goods or services to people in India, and every Indian subsidiary of a foreign group, needs to be ready.

The good news is that the DPDP framework is simpler than the GDPR in several respects, and global privacy programmes provide a strong starting point. The work lies in the India-specific details: consent without a legitimate interests fallback, an age of 18, universal breach reporting, plain-language and Indian-language notices, and contracts that keep processors in line. Companies that start now will be ready on time; those that wait for the Board's first enforcement actions will be rebuilding under pressure.

Book a DPDP readiness review

We will assess whether and how the DPDP Act applies to your business, map your Indian data flows and give you a prioritised plan to 13 May 2027.

Book a consultation About Delhi Legal Company

Call +91-9599332456  |  Email info@delhilegalcompany.com

?Frequently asked questions

---

Does the DPDP Act apply to a foreign company with no presence in India?

Yes, if it processes digital personal data outside India in connection with offering goods or services to individuals in India. No Indian entity, office or server is needed for the Act to apply.

When do the main DPDP obligations apply?

From 13 May 2027. This includes notice and consent, security safeguards, breach intimation, data principal rights, children's data, retention, significant data fiduciary duties and cross-border transfer provisions.

What happens on 13 November 2026?

The consent manager framework under Rule 4 comes into force. Eligible Indian companies can register with the Data Protection Board as consent managers. Businesses are not required to use them, but should prepare to recognise consents managed through them.

How quickly must a data breach be reported?

Affected individuals and the Data Protection Board must be informed without delay, and a detailed report must be submitted to the Board within 72 hours, unless the Board allows more time. All personal data breaches must be reported, not only high-risk ones.

Can we transfer Indian personal data to our parent company abroad?

Generally yes. The Act permits transfers to any country unless the Government restricts a specific country. Sectoral localisation rules, any Government orders under Rule 15, and specific requirements for significant data fiduciaries must also be followed.

Does our GDPR programme make us compliant with the DPDP Act?

Not entirely. Key differences include the absence of a legitimate interests basis, the definition of a child as anyone under 18, mandatory reporting of all breaches, Indian-language notice options and the consent manager framework.

Do we need to appoint a Data Protection Officer in India?

Only if you are notified as a significant data fiduciary, in which case the DPO must be based in India. Other fiduciaries must publish the contact details of a person who can answer questions about processing.

What are the maximum penalties?

Up to ₹250 crore per instance for failing to take reasonable security safeguards, up to ₹200 crore for failure to notify breaches or for breaches of obligations relating to children, up to ₹150 crore for SDF breaches and up to ₹50 crore for other breaches.

Does the Act apply to employee data?

Yes. Employee data is personal data. Processing for employment purposes is a recognised legitimate use, but security, retention, breach and rights obligations still apply.

What should a foreign company do first?

Confirm whether and how the Act applies, identify the entities acting as data fiduciaries, and map the Indian personal data you process. Everything else, from notices to contracts, depends on that map.