Foreign companies offering goods or services to individuals in India should begin preparing now for India’s Digital Personal Data Protection framework. The Digital Personal Data Protection Act, 2023 (DPDP Act) can apply even where the company and its servers are outside India, provided the processing relates to offering goods or services to Data Principals in India. MeitY
The final Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, but implementation is phased. Most of the substantive compliance provisions are scheduled to take effect 18 months after publication, while certain provisions relating to Consent Managers take effect after one year. MeitY
For overseas businesses, this transition period is therefore not a reason to wait. It is the time to identify Indian data flows, update contracts and notices, test breach-response procedures and decide who will be responsible for Indian privacy compliance.
Does India’s DPDP Act Apply to Foreign Companies?
Yes. Section 3(b) of the DPDP Act expressly gives the law an extra-territorial reach.
It applies to processing of digital personal data outside India where that processing is connected with an activity involving the offering of goods or services to Data Principals within India. MeitY
A foreign company may therefore fall within the Indian regime even if it:
has no incorporated subsidiary in India;
processes the relevant data outside India;
uses overseas cloud infrastructure; or
operates through a global website or application.
The important question is whether its activity involves offering goods or services to individuals in India.
For businesses establishing a more permanent presence in India, Edvisars’ guide on company registration in India for foreign founders explains the wider incorporation and regulatory framework.
How this may arise in practice
An overseas SaaS provider selling subscriptions to Indian customers, an international e-commerce platform serving Indian buyers, or a global service business collecting information from Indian users may all need to examine the DPDP framework.
When Will the Main DPDP Obligations Become Effective?
The DPDP regime is being commenced in stages rather than on a single date.
The Government's commencement notification dated 13 November 2025 brought provisions concerning matters such as the establishment and functioning of the Data Protection Board into force immediately. Certain Consent Manager provisions are scheduled for one year after publication, while the principal provisions dealing with consent, Data Fiduciary obligations, individual rights, children’s data, Significant Data Fiduciaries and penalties are scheduled for 18 months after publication. MeitY
Similarly, under Rule 1 of the DPDP Rules:
Rules 1, 2 and 17–21 commenced upon publication;
Rule 4 commences one year after publication; and
Rules 3, 5–16, 22 and 23 commence 18 months after publication. MeitY
On that timetable, most operational requirements are expected to become applicable in May 2027.
Foreign companies should therefore treat the current period as an implementation window rather than wait until the effective date.
What Should Foreign Companies Do Before Full Implementation?
The first task should be to identify what personal data connected with India is actually being processed and why.
A practical DPDP readiness exercise should cover the following areas.
1. Map Personal Data Connected With India
Companies should identify:
what Indian customer or user data they collect;
where that information is stored;
why it is processed;
which group companies receive it;
which processors and cloud providers handle it;
how long it is retained; and
whether children’s data is processed.
This exercise is important because a business cannot properly design notices, consent mechanisms, deletion procedures or breach controls without first understanding its data flows.
2. Review Privacy Notices and Consent Mechanisms
The final Rules require notices to provide a clear and independently understandable explanation of the personal data involved and the purposes for which it will be processed.
Rule 3 requires, among other things, an itemised description of personal data and a specific description of the purposes or services connected with the processing. MeitY
Foreign businesses relying on one global privacy policy should therefore assess whether it gives Indian Data Principals the information required by the Indian regime.
The safest approach may not always be to create an entirely separate Indian privacy policy. Depending on the business, an India-specific section or notice layer may be more practical.
3. Review Vendor and Data-Processor Contracts
The DPDP framework places responsibility on the Data Fiduciary even where personal data is processed by another organisation on its behalf.
Rule 6 specifically contemplates appropriate contractual provisions between a Data Fiduciary and its Data Processor for maintaining reasonable security safeguards. MeitY
Foreign businesses should therefore review agreements with:
cloud providers;
CRM vendors;
payment and customer-support platforms;
analytics providers;
outsourcing companies; and
other vendors processing Indian personal data.
Contracts should clearly deal with information security, incident reporting, deletion or return of information, permitted processing and cooperation with regulatory or Data Principal requests.
Edvisars’ broader commercial contracts and cross-border advisory practice may also be relevant where privacy obligations need to be incorporated into Indian commercial arrangements.
Foreign companies should not assume that their existing global vendor agreements automatically meet the requirements of India’s DPDP framework. They should check whether their contracts clearly state how Indian personal data may be used, what security measures vendors must follow, and how quickly a vendor must report a data breach. It is equally important to ensure that vendors return or delete personal data when the arrangement ends and assist the company in responding to requests from individuals or regulatory authorities.
Companies should also identify which vendors have access to personal data and whether that access is still necessary. Where existing contracts do not adequately address these issues, the relevant clauses should be updated before the applicable compliance requirements take effect. Taking these steps early can help avoid last-minute contract changes and reduce the risk of disputes or compliance gaps.
4. Prepare for India's Data-Breach Requirements
The final Rules provide considerably more detail on breach reporting.
Rule 7 requires affected Data Principals to receive specified information without delay after the Data Fiduciary becomes aware of a personal data breach.
The Data Protection Board must also receive an initial intimation without delay, followed by further specified information within 72 hours of awareness, unless the Board permits a longer period on a written request. MeitY
This means foreign companies should not assume that their GDPR, US state privacy or other international incident-response procedure will automatically satisfy Indian requirements.
Their breach plan should answer, before an incident occurs:
Who decides whether an Indian personal data breach has occurred?
Who will communicate with the Data Protection Board?
Who prepares notices to Indian Data Principals?
Can overseas processors notify the company quickly enough?
Can the organisation assemble the information required within 72 hours?
5. Check Whether Your Security Programme Meets the DPDP Rules
Rule 6 sets out minimum elements of reasonable security safeguards.
The Rules refer to measures including encryption, masking or tokenisation where appropriate, access controls, logging and monitoring, backups, incident-detection arrangements and appropriate technical and organisational controls. MeitY
The Rules also require relevant logs and personal data connected with security and incident-management requirements to be retained for the specified period, including a one-year period in the circumstances described by Rule 6. MeitY
Foreign companies should compare these requirements against their existing cybersecurity policies rather than assume that ISO certification or compliance with another privacy regime automatically establishes Indian compliance.
6. Build a Process for Data Principal Requests
The Act gives Data Principals rights concerning access to information, correction, updating and erasure, grievance redressal and nomination, subject to the statutory framework.
The Rules also require Data Fiduciaries to provide an accessible mechanism through which such rights can be exercised.
A global company should therefore be able to:
identify an Indian Data Principal;
route the request to the correct team;
locate the relevant information;
determine whether retention remains legally required;
respond within its stated grievance-redressal framework; and
maintain evidence of how the request was handled.
A company with several global databases should test this process before the substantive requirements commence.
7. Examine Data Transfers Outside India
The DPDP framework does not presently create a general requirement that all personal data remain stored in India.
Section 16 of the Act permits the Central Government to restrict transfers to specified countries or territories by notification. It also preserves stricter requirements that may arise under another applicable Indian law. MeitY
Rule 15 additionally provides that transfers outside India will be subject to requirements that the Central Government may specify concerning making such personal data available to a foreign State, or persons or entities under the control of or agencies of such a State. India Code
Accordingly, companies should avoid two opposite assumptions: that cross-border transfers are prohibited, or that they will remain completely unrestricted.
Sector-specific localisation or transfer requirements applicable to banking, payments, insurance or other regulated activities must also be considered separately.
8. Determine Whether Children Use Your Service
Under the DPDP Act, a child means an individual who has not completed eighteen years of age.
The framework imposes specific requirements concerning the processing of children's personal data, including verifiable parental consent, subject to the statutory provisions and prescribed exemptions.
Rules 10 and 11 explain how verifiable consent is to be addressed for children and for persons with disabilities who have lawful guardians. MeitY
Foreign platforms using a lower age threshold under another jurisdiction should therefore specifically check their Indian user journey.
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 has also made limited textual corrections to sections 9 and 10 of the Act, including clarifying the wording concerning a person with disability who has a lawful guardian and the reference to a “data audit”. These changes do not alter the broader implementation timetable. MeitY
9. Decide Who Owns DPDP Compliance Internally
A recurring implementation problem for international organisations is not the absence of policies but the absence of a clearly responsible team.
Responsibility may need to be allocated among:
legal;
compliance;
information security;
product teams;
HR;
customer support; and
regional management.
A foreign parent with an Indian subsidiary should also decide whether compliance will be handled centrally, locally or through a combined structure.
Companies entering India more broadly may also find Edvisars’ India entry and cross-border advisory resources useful when coordinating privacy compliance with corporate, contractual and operational requirements.
What Should Foreign Companies Prioritise Right Now?
The most useful approach is to focus first on changes that take time to implement.
Before the principal DPDP provisions become operational, foreign businesses should ideally complete:
an India-specific data inventory;
a review of privacy notices and consent architecture;
vendor and processor contract reviews;
breach-response testing;
Data Principal rights procedures;
retention and deletion rules;
children's-data assessment;
cross-border transfer analysis; and
assignment of internal compliance responsibility.
Technical changes, particularly age verification, deletion workflows and product-level consent mechanisms, can require development cycles and should not be left until the final weeks before commencement.
Does GDPR Compliance Automatically Mean DPDP Compliance?
No.
A company with a mature GDPR programme will already have useful privacy governance systems, but the Indian framework has its own terminology, lawful-processing structure, children's-data rules, notice requirements, breach procedures and regulatory architecture.
The better approach is to map the DPDP requirements against the company's existing global privacy framework and identify only the gaps that require India-specific changes.
This can reduce duplication while ensuring that assumptions based on foreign law do not create compliance gaps in India.
FAQs
Can the DPDP Act apply to a company with no Indian office?
Yes. Section 3(b) can apply to processing outside India where it relates to offering goods or services to Data Principals in India. MeitY
Are the DPDP Rules still only in draft form?
No. The final Digital Personal Data Protection Rules, 2025 were notified in November 2025. MeitY
Are all DPDP obligations already enforceable?
No. Commencement is phased, with most substantive operational provisions scheduled for 18 months after the November 2025 publication date. MeitY
Must foreign companies store all Indian personal data in India?
The DPDP Act does not impose a general localisation requirement for all personal data. However, Government transfer restrictions and separate sector-specific Indian laws or regulations may apply.
Does a foreign business need an India-specific privacy policy?
Not necessarily. The legal question is whether the notices supplied to Indian Data Principals satisfy the DPDP requirements. An India-specific notice or supplement may nevertheless be commercially simpler for some businesses.
Will processors also need contractual protections?
Yes. Rule 6 expressly contemplates appropriate provisions in contracts between Data Fiduciaries and Data Processors concerning reasonable security safeguards. MeitY
What is the breach-reporting deadline?
The Rules require initial intimation to the Board without delay and specified additional information within 72 hours of awareness, unless the Board allows a longer period. Affected Data Principals must also be informed without delay as prescribed. MeitY
Should companies wait until 2027 to begin implementation?
That would create unnecessary compliance risk. Data mapping, contract amendments, technical changes and incident-response preparation can require substantial lead time.
Where can businesses check the official DPDP documents?
The official Act is available through India Code – Digital Personal Data Protection Act, 2023, while the final Rules and related notifications are available through MeitY's DPDP Rules materials.
