/ Foreign Clients · DPDP Act · Updated 2026-10-15

DPDP Act India, applies to foreign companies too.

India's Digital Personal Data Protection Act 2023 (DPDP Act) is India's first comprehensive data protection law. Extraterritorial reach: applies to any entity (Indian or foreign) processing personal data of Indian residents (data principals) in connection with offering goods / services. US SaaS selling to Indian users is in scope. UK fintech with Indian customers in scope. Penalty up to INR 250 crore per breach. Here's the complete 2026 practitioner's framework.

Get a firm quote → WhatsApp instead

Written by CA Durgesh Chavda

Chartered Accountant (ICAI) · Founder, Bharat Quantum Prospera · US incorporation, India-US DTAA, FEMA ODI, NRI taxation, cross-border structuring · LinkedIn

/ Scope + applicability

Who is caught.

Section 3 DPDP Act applies to processing of digital personal data:

Within India, if personal data is collected (a) in digital form, OR (b) in non-digital form and digitised subsequently.
Outside India, if processing is in connection with any activity related to offering of goods or services to data principals (persons) within India.

Translation for foreign companies:

US SaaS company with Indian paying users (B2C): in scope.
US e-commerce selling to Indian consumers: in scope.
UK fintech serving Indian customers: in scope.
European media platform with Indian subscribers: in scope.
Singapore AI chatbot with Indian users: in scope.
Any processing of Indian individual's email, phone, name, address, device identifier, financial info, location, etc.: in scope.

'Personal data' broad: anything that identifies or can identify an individual.

/ Core compliance obligations

What foreign companies must do.

Legitimate ground: process personal data only based on (a) consent, or (b) 'certain legitimate uses' (specified Section 7: employment, performance of contract, legal obligation, public interest, specified medical / disaster response).
Notice (Section 5): before/at consent, data principal must receive clear notice of: personal data to be processed, purpose, how to withdraw consent, grievance mechanism, how to make complaint to Data Protection Board.
Consent (Section 6): must be free, specific, informed, unconditional, unambiguous. Easy withdrawal. Linguistic requirements (notice in English + any of 22 scheduled Indian languages).
Purpose limitation: process only for specified purpose; obtain fresh consent for new purposes.
Data accuracy (Section 8): Data Fiduciary must take reasonable efforts to ensure accuracy + completeness.
Security safeguards (Section 8(5)): reasonable security safeguards to prevent personal data breach.
Breach notification (Section 8(6)): on becoming aware of personal data breach, notify Data Protection Board AND each affected data principal.
Data erasure (Section 8(7)): delete personal data once purpose served or consent withdrawn.
Grievance redressal: appoint grievance officer; respond within reasonable time.
Rights of data principal (Section 11-14): right to information, correction, erasure, grievance redressal, nominate successor.
Children's data: verifiable parental consent for processing data of persons under 18 (default; may be lowered to 14 by regulations). No targeted advertising to children.
Persons with disabilities: consent of lawful guardian.

/ Significant Data Fiduciary

The elevated tier.

Section 10: Central Government may notify any Data Fiduciary / class as 'Significant Data Fiduciary' (SDF) based on factors: volume + sensitivity of personal data, risk to rights of data principals, impact on sovereignty, security of state, public order.
Additional obligations for SDF:
— Appoint Data Protection Officer based in India (natural person representing SDF).
— Appoint independent Data Auditor to assess compliance.
— Periodic Data Protection Impact Assessment (DPIA) + periodic audit.
— Other measures as Central Government specifies.
Likely SDF candidates: large social media (Meta, X, Google), large fintech, large health platforms, large e-commerce. Specific notifications pending (Rules in draft 2024-2025).

/ Cross-border data transfer

The sovereign carve-out.

Section 16: Central Government may notify countries / territories to which personal data of Indian residents may NOT be transferred.
'Blocklist' approach: unlike GDPR (adequacy decision whitelist), DPDP uses notifications of restricted jurisdictions.
Current state (2026): no restrictions notified yet; cross-border transfer currently unrestricted subject to other sectoral regulations (RBI payment data localisation, SEBI data retention, etc.).
Prudent approach: foreign Data Fiduciary should document cross-border flows, Data Processing Agreements (DPAs) with India-side processors, Standard Contractual Clauses (SCCs) adapted for India, data residency for sensitive sectors (payment data per RBI).

/ Penalties + Data Protection Board

The enforcement.

Data Protection Board of India (Section 18-20): statutory body for enforcement. Investigates complaints; issues orders; imposes penalties.
Penalty structure (Section 33 + Schedule):
— Failure to take reasonable security safeguards to prevent breach: up to INR 250 crore.
— Failure to notify Data Protection Board of breach: up to INR 200 crore.
— Non-fulfilment of obligations on processing children's data: up to INR 200 crore.
— Non-fulfilment of SDF obligations: up to INR 150 crore.
— Breach of other provisions: up to INR 50 crore.
Appeal: TDSAT (Telecom Disputes Settlement and Appellate Tribunal) within 60 days.
Effective date: DPDP Act enacted August 2023; staggered notification of provisions during 2024-2026. Draft Rules circulated January 2025.

Last updated: 2026-10-15.

/ Ready when you are

Foreign SaaS / e-commerce / fintech handling Indian user data?

DPDP Act applies extraterritorially. INR 250 crore penalty exposure. BQP: applicability analysis + gap analysis + consent flow + DPA + breach plan + ongoing compliance. Scope-based engagement.

Get a firm quote → WhatsApp Durgesh

FAQ

Common questions, answered.

Does DPDP Act apply to foreign companies without an Indian entity?

Yes - extraterritorial reach under Section 3(b). Any entity processing personal data of Indian residents (data principals) 'in connection with any activity related to offering of goods or services' to persons in India is in scope. US SaaS with Indian users, UK e-commerce selling to Indian consumers, Singapore app with Indian subscribers all captured. No Indian entity required for the Act to apply.

What is a Significant Data Fiduciary under DPDP?

Entity notified by Central Government as SDF based on volume + sensitivity of personal data handled, risk to data principals, impact on sovereignty / state security / public order. Additional obligations: India-based Data Protection Officer, independent Data Auditor, periodic DPIA, periodic audit. Likely candidates: large social media, fintech, health, e-commerce. Specific SDF notifications pending via Rules.

Can foreign company transfer Indian personal data abroad under DPDP?

Currently yes - Section 16 provides 'blocklist' approach: Central Government may notify specific countries to which transfer is restricted. No restrictions notified yet (2026). Cross-border transfer currently unrestricted subject to sectoral regulations (RBI payment data localisation, SEBI data retention rules). Prudent approach: document cross-border flows, DPAs with India-side processors, data residency for sensitive sectors.

What's the DPDP penalty for data breach?

Up to INR 250 crore (~USD 30 million) for failure to take reasonable security safeguards to prevent breach. Separately: up to INR 200 crore for failure to notify Data Protection Board of breach. Penalties under Section 33 + Schedule to the Act. Appeal to TDSAT within 60 days. Enforcement effective from Rules notification date (staggered 2024-2026).

How does DPDP compare to GDPR for a foreign company?

Similar concepts: lawful basis for processing, data principal rights, Data Protection Officer for SDFs, breach notification, extraterritorial reach. Differences: DPDP has 'blocklist' approach to cross-border transfer (vs GDPR adequacy whitelist); DPDP consent emphasis (narrower 'legitimate interests'); DPDP specifically governs children (under 18) + persons with disabilities. Foreign companies compliant with GDPR need India-specific adjustments but core governance framework translates.

Does BQP handle DPDP compliance for foreign companies?

Yes - DPDP applicability analysis, gap analysis against existing compliance (if GDPR-compliant), consent flow design, notice drafting (English + Indian languages), Data Processing Agreement (DPA) templates, breach response plan, SDF-tier obligations if applicable, Data Protection Officer appointment, periodic DPIA + audit. Co-ordinated with foreign client's global privacy counsel. WhatsApp +91 78018 87130.