Short answer: India’s Digital Personal Data Protection Act 2023 (the DPDP Act) applies to processing of digital personal data in India, including by an Indian subsidiary or global capability centre (GCC), and to processing abroad connected with offering goods or services to people in India [1]. The Act’s main obligations, including the offshore reach, breach reporting, the transfer power and penalties (up to INR 250 crore, about GBP 19.7m, for a security failure), start on 13 May 2027; until then the IT Act’s section 43A regime applies, and CERT-In’s 6-hour incident reporting applies throughout [1][2][7]. An offshore processor’s DPDP duties come through its contract with the business it serves (the Data Fiduciary), and an Indian GCC that processes only data of people outside India under a contract with a foreign company keeps just the accountability and security duties [1].

Who this is for: general counsel, DPOs and CFOs of UK, US and European companies that sell to people in India, run an Indian subsidiary or GCC, or process Indian personal data offshore.

Table of Contents

When the DPDP Act and the DPDP Rules 2025 apply

The commencement notification (G.S.R. 843(E)) and the DPDP Rules 2025 (G.S.R. 846(E)), both of 13 November 2025, phase in the Act of 11 August 2023 [1][2][3][4]:

Date	What starts	Provisions
13 Nov 2025	Definitions; the Data Protection Board; general and rule-making provisions; TRAI Act and RTI Act amendments	s.2, ss.18–26, 35, 38–43, 44(1) and (3); Rules 1, 2, 17–21
13 Nov 2026 (one year)	Registration of consent managers, which must be Indian companies with net worth of at least INR 2 crore (about GBP 157,000)	s.6(9), s.27(1)(d); Rule 4 and First Schedule Part A [3][5]
13 May 2027 (18 months)	Everything else, including territorial reach, fiduciary duties, Significant Data Fiduciaries (SDFs), rights, transfers, exemptions and penalties; omission of IT Act s.43A	ss.3–17 (except s.6(9)), 27 (except (1)(d)), 28–34, 36–37, 44(2); Rules 3, 5–16, 22, 23

India Code’s footnote lists “ss.35 to 43” in the first group but also ss.36 and 37 in the 18-month group, where the table places them [2]. No penalty can be imposed under the Act before 13 May 2027 [2]. Until then, section 43A of the Information Technology Act 2000 (compensation for negligent failure to protect sensitive personal data) and its 2011 rules continue to apply; s.44(2) of the DPDP Act omits section 43A from that date [1][2].

Does India’s data protection law apply to a company outside India?

Section 3(a) covers any processing of digital personal data within India, so an Indian subsidiary, GCC, branch or vendor is caught directly [1]. Section 3(b) adds processing abroad “in connection with any activity related to offering of goods or services to Data Principals within the territory of India”. There is no limb for monitoring behaviour, and the test is where the person is, not citizenship or residence. Paper records that are never digitised fall outside s.3(a); personal or domestic use, and data made public by the individual or under a legal duty, are excluded by s.3(c).

GCCs and outsourcers: the section 17(1)(d) exemption

Chapter II (except s.8(1) and (5)), Chapter III and s.16 do not apply where “personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India” (s.17(1)(d)) [1]. For a GCC running its German parent’s European payroll, that data carries:

no consent, notice, children’s, SDF, rights or s.16 duties, and no duty to notify breaches to the Board or to individuals;
two remaining duties, accountability (s.8(1)) and reasonable security safeguards (s.8(5)), which bind the Data Fiduciary: usually the foreign parent or client, unless the GCC itself decides purpose and means.

The GCC’s own staff data, and any data about people in India, stays fully in scope; staff data may be processed without consent for employment purposes (s.7(i)), alongside the GCC’s other employment law obligations in India [1]. The GCC’s entry route is covered in FDI in India: rules, routes and approvals (2026).

Fiduciary or processor: where the duties sit

The duties sit on the Data Fiduciary, which “determines the purpose and means” of processing (s.2(i)); a processor that decides them becomes one. The fiduciary answers for its Data Processor “irrespective of any agreement to the contrary” and must bind it by a valid contract on security and erasure, keeping a year’s logs of its work (s.8(1), (2), (5), (7)(b); Rules 6(1)(f), 8(3)) [1][3]. A foreign processor’s exposure is otherwise contractual.

Decision table: which DPDP obligations apply to you from 13 May 2027

Your position	DPDP role	What applies
Offshore company selling to people in India	Data Fiduciary (s.3(b))	All fiduciary duties and Data Principal rights; children’s rules; Rule 15 transfer conditions
Indian subsidiary or GCC processing data of its staff or of people in India	Data Fiduciary, or processor for its parent (s.3(a))	Full duties; staff data under s.7(i)
GCC or vendor processing only data of people outside India under a foreign contract	Partly exempt (s.17(1)(d))	Only s.8(1) and s.8(5) (INR 250 crore cap); no Board breach notice; CERT-In still applies
Offshore processor for an Indian business	Data Processor	Contract terms: security, erasure, one-year logs; transfer allowed unless s.16 or a sector rule bars it
Any of these notified as an SDF	SDF	Add: India-based Data Protection Officer (DPO), independent data auditor, annual impact assessment and audit, possible localisation (Rule 13)

Sources: [1][3].

Core duties: consent, legitimate uses, notice and children

The general obligations are summarised in data protection and privacy in India; for foreign groups these points matter most [1][3]:

Consent or a listed use. Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” and as easy to withdraw as to give; the alternative is one of nine listed “legitimate uses”, with no general legitimate-interests ground (ss.4, 6, 7).
Notice. A stand-alone notice itemising data and purposes, with links to withdraw, exercise rights and complain to the Board (s.5; Rule 3); people who consented before the Act’s commencement (s.5 itself starts on 13 May 2027) must get one “as soon as it is reasonably practicable” (s.5(2)).
Children (under 18). Verifiable parental consent, checked against identity and age details already held or a virtual token from an authorised entity, and no “tracking or behavioural monitoring of children or targeted advertising directed at children” (ss.2(f), 9; Rule 10).
Rights and retention. Grievances must be answered within a published period of no more than 90 days (Rule 14(3)); data is erased once the purpose ends, but personal data, traffic data and logs are kept for at least one year (s.8(7); Rule 8(3)).

Significant Data Fiduciaries and Rule 13

The Government may notify any fiduciary or class as an SDF, weighing factors such as data volume and sensitivity and risks to Data Principals or the State; an SDF then has the extra duties in the decision table, including due diligence on its algorithmic software (s.10; Rule 13(1)–(3)) [1]. Under Rule 13(4) it must keep in India any personal data the Government specifies on a committee’s recommendation, and its traffic data [1][3][6]. Because s.10 and Rule 13 start only on 13 May 2027, no SDF had been designated, and no data specified, as at 15 October 2026.

Cross-border transfers under the DPDP Rules 2025: a restriction list, not a permitted list

“The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified” (s.16(1)) [1]. Transfers are allowed unless the destination is notified; there is no approved-country list, prescribed contract or transfer assessment. Section 16 starts on 13 May 2027; as at 15 October 2026 no country had been notified [2]. Three overlays apply:

Rule 15: the Government may set requirements on making transferred data available to a foreign State, or to an entity under its control or one of its agencies [3].
Rule 13(4): localisation of specified data, for SDFs only.
Stricter sector laws continue (s.16(2)). Under the Reserve Bank of India’s 2018 direction, payment system providers must store “the entire data relating to payment systems operated by them” in a system only in India [1][9].

Breach reporting: CERT-In now, the Board from 13 May 2027

Section 8(6) has no materiality threshold, so one incident can start three clocks [1]:

Report to	Deadline
CERT-In (in force now)	Within 6 hours of noticing the incident [7]
Data Protection Board	“Without delay”; then a detailed report within 72 hours of becoming aware, unless the Board allows longer (s.8(6); Rule 7(2)) [3]
Each affected Data Principal	“Without delay”, in plain language, with likely consequences and safety steps (Rule 7(1)) [3][6]

CERT-In also requires a point of contact and 180 days of ICT logs, kept in India under the direction, though its FAQs accept logs held abroad if they can be produced on request [7][8]. The first-day sequence is in legal priorities in the first 24 hours after a cyber-attack.

Penalties and the Data Protection Board

Breach (Schedule item)	Maximum (INR)	GBP / USD / EUR
1. Reasonable security safeguards, s.8(5)	250 crore	19.7m / 26.0m / 23.4m
2. Breach notice to the Board or Data Principals, s.8(6)	200 crore	15.7m / 20.8m / 18.7m
3. Children, s.9	200 crore	15.7m / 20.8m / 18.7m
4. SDF obligations, s.10	150 crore	11.8m / 15.6m / 14.0m
5. Data Principal duties, s.15	10,000	79 / 104 / 93
6. Breach of a voluntary undertaking, s.32	Up to the original breach’s amount	—
7. Any other provision of the Act or Rules	50 crore	3.9m / 5.2m / 4.7m

Sources: [1][6]; rounded exchange rates, October 2026.

The Board may penalise only a “significant” breach, weighing gravity, mitigation and proportionality; the caps are fixed per item, not linked to turnover (s.33; Schedule) [1]. Penalties go to the Consolidated Fund of India; the Act gives individuals no compensation route and bars civil courts from matters the Board can decide (ss.34, 39). Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (s.29) [1][5]. After penalties in two or more cases, the Government may, on the Board’s reference, block public access in India to a fiduciary’s service (s.37) [1].

In its answer to Parliament of 12 August 2026, the Government said the Board’s Chairperson and four Members “are to be appointed through a Search-cum-Selection Committee”; MeitY had invited applications on 6 May 2026 and advertised the posts in Employment News on 6 June 2026 [4][10].

Worked example (illustrative)

Hypothetical. FX: INR 127 = GBP 1, INR 96 = USD 1, INR 107 = EUR 1 (rounded exchange rates, October 2026). Penalties shown are statutory maximums, not predictions.

A UK online retailer sells from the UK to 3 million registered users in India. Its 250-person Bengaluru GCC handles customer service for UK and EU customers under an intra-group agreement with the parent.

Roles. UK parent: Data Fiduciary for its Indian users (s.3(b)). GCC: within s.17(1)(d) for UK and EU data, so only s.8(1) and (5) apply, binding the parent; a fiduciary for its own staff (s.7(i)).
Breach in July 2027. A misconfigured storage bucket exposes Indian users’ orders, and the retailer tells neither the Board nor its users. Maximums: item 1, INR 250 crore (GBP 19.7m), plus item 2, INR 200 crore (GBP 15.7m), makes INR 450 crore; 4,500,000,000 ÷ 127 = GBP 35.4m (USD 46.9m; EUR 42.1m). The Act does not say how the Board treats two items arising from one incident; prompt notice removes item 2.
The same incident at the GCC, EU data only. No DPDP notice duty; item 1 alone, up to INR 250 crore (GBP 19.7m); a CERT-In report within 6 hours.

Risks and common mistakes, ranked

Treating 13 May 2027 as the date to start. The 18-month transition ends that day [2].
Assuming the GCC is out of scope. Section 17(1)(d) covers only foreign data under a foreign contract, and security duties still apply [1].
Planning for one clock. CERT-In’s 6 hours runs now and will run alongside the Board’s [3][7].
Reading s.16 as a permitted-country list. The live constraints are sector rules such as the RBI’s, Rule 15 and, for SDFs, Rule 13(4) [1][9].
Assuming the dates cannot move. MeitY was reported in January 2026 to be weighing a 12-month deadline for some SDF duties, immediate effect for the transfer and information-request powers and a 90-day start for one-year retention; no amendment had been notified as at 15 October 2026, and the August 2026 Lok Sabha answer still gave 18 months [4][11]. Supreme Court petitions against parts of the Act, including s.36 and the RTI amendment in s.44(3), are pending; a three-judge bench refused a stay on 16 February 2026, and on 7 August 2026 the Union undertook to file its reply [12][13].
Leaving data protection out of diligence on an Indian target (consents, notices, breach history); see Joint venture in India or acquisition: deal structure and shareholder protections.

Checklist to forward internally

☐ Data of people in India mapped; each entity classed as fiduciary or processor
☐ Contracts within s.17(1)(d) listed, and the data outside them
☐ Lawful ground per purpose; Rule 3 notice; s.5(2) plan for existing users; grievance channel (90 days)
☐ Under-18 users: verifiable parental consent; no targeted ads
☐ Processor contracts: security, erasure, one-year logs
☐ Breach playbook: CERT-In 6 hours; Board and individuals without delay; 72-hour report
☐ RBI localisation checked; SDF risk assessed; notifications under s.16 and Rules 13 and 15 watched

For the commercial side of setting up and running a GCC, see Setting Up a Global Capability Centre in India: The Foreign Company’s Guide (ATB Corporate).

About ATB Legal

ATB Legal is a law firm advising on Indian and UAE law. Its work covers corporate and commercial matters, foreign investment and exchange control, mergers and acquisitions, international trade and customs, and dispute resolution, including arbitration. Contact details.

This article is general information, not legal advice, and is not a solicitation of work. Under the Bar Council of India rules, Indian advocates may not advertise or solicit work.

FAQ

Does the DPDP Act apply to a foreign company with no office or servers in India? Yes, from 13 May 2027 the DPDP Act applies to a foreign company with no office or servers in India if it processes digital personal data in connection with offering goods or services to people within India (s.3(b)) [1][2].

Does the DPDP Act apply to a GCC in India that processes only foreign customers’ data? Only two DPDP duties apply when a GCC in India processes data of people outside India under a contract with a foreign company: accountability (s.8(1)) and reasonable security safeguards (s.8(5)), binding the Data Fiduciary, with a maximum penalty of INR 250 crore (about GBP 19.7m) [1]. The rest of Chapters II and III, and s.16, do not apply to that data (s.17(1)(d)), but the GCC’s own staff data stays in scope and CERT-In’s 6-hour rule applies regardless [7].

Is an offshore data processor directly liable under India’s DPDP Act? Generally no, an offshore data processor is not directly liable under the DPDP Act: the Act places its duties on the Data Fiduciary, which answers for its processor “irrespective of any agreement to the contrary”, so the processor’s obligations come through its contract (s.8(1), (2)) [1]. That contract covers security and erasure, while the fiduciary keeps a year’s logs of the processor’s work (s.8(7)(b); Rules 6(1)(f), 8(3)) [3]. Two exceptions matter: a processor that decides purposes or means becomes a fiduciary, and the residual penalty of up to INR 50 crore is not limited to fiduciaries in its wording.

Can an Indian company send personal data to a processor in the UK, US or EU under the DPDP Rules 2025? Yes, an Indian company can send personal data to a processor in the UK, US or EU unless the Government notifies that country as restricted under s.16(1) of the DPDP Act, and none had been notified as at 15 October 2026 [1][2]. There are no adequacy decisions or standard contracts to adopt; Rule 15 conditions on foreign-State access, Rule 13(4) for SDFs and sector rules such as the RBI’s payment data direction still apply [3][9].

Does a foreign company need a Data Protection Officer or a representative in India? The DPDP Act does not require a foreign company to appoint a representative in India, and requires a Data Protection Officer only of a Significant Data Fiduciary, whose DPO must be based in India (s.10(2)(a)) [1]. Other fiduciaries publish a contact person for Data Principals’ questions (s.8(9)); CERT-In’s FAQs separately expect a point of contact for cyber incidents [8].

Does India’s data protection law have a legitimate-interests ground like the GDPR? No, India’s data protection law has no general legitimate-interests ground: outside the nine “legitimate uses” in s.7 of the DPDP Act, processing needs consent that is free, specific, informed, unconditional and unambiguous [1]. The listed uses include employment (s.7(i)), legal obligations, medical emergencies and compliance with judgments, including foreign judgments on contractual or civil claims (s.7(e)).

Sources

Ministry of Electronics and Information Technology (MeitY), The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India print (ss.2, 3, 4–17, 29, 33, 34, 37, 39, 42, 44(2); Schedule) (11 August 2023) — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (accessed 15 October 2026)
India Code, The Digital Personal Data Protection Act, 2023, consolidated as on 19 November 2025, footnote to s.1(2) citing commencement notification G.S.R. 843(E) of 13 November 2025 (November 2025) — https://indiacode.gov.in/handle/123456789/496508 (accessed 15 October 2026)
MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Rules 1, 3, 4, 6, 7, 8, 10, 13, 14, 15; First Schedule) (13 November 2025) — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf ; corrigenda, G.S.R. 892(E) (10 December 2025) — https://egazette.gov.in/WriteReadData/2025/268455.pdf (accessed 15 October 2026)
Lok Sabha, Unstarred Question No. 3960, answered by the Minister of State for Electronics and Information Technology: Data Protection Board appointments, consent managers and implementation phases (12 August 2026) — https://sansad.in/getFile/lsapps/loksabhaquestions/annex/188/AU3960_GyWSTk.pdf (accessed 15 October 2026)
Press Information Bureau (MeitY), “Government notifies DPDP Rules to empower citizens and protect privacy” (14 November 2025) — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014 (accessed 15 October 2026)
Press Information Bureau, backgrounder “DPDP Rules, 2025 Notified” (17 November 2025) — https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf (accessed 15 October 2026)
CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act 2000, No. 20(3)/2022-CERT-In (28 April 2022) — https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf (accessed 15 October 2026)
CERT-In, FAQs on the Cyber Security Directions of 28 April 2022 (May 2022) — https://www.cert-in.org.in/PDF/FAQs_on_CyberSecurityDirections_May2022.pdf (accessed 15 October 2026)
Reserve Bank of India, “Storage of Payment System Data”, RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018 (6 April 2018) — https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244&Mode=0 (accessed 15 October 2026)
MeitY, circular F. No. 2(1)/2026-Pers.I inviting applications for the posts of Chairperson and Members of the Data Protection Board of India (6 May 2026) — https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf (accessed 15 October 2026)
Business Standard, “Meity may cut compliance timeline for key DPDP rules to 12 months” (22 January 2026) — https://www.business-standard.com/technology/tech-news/meity-may-cut-compliance-timeline-for-key-dpdp-rules-to-12-months-126012201293_1.html (accessed 15 October 2026)
LiveLaw, “‘Some Creases To Be Ironed Out,’ Supreme Court Refers Pleas Challenging DPDP Act Amendment To RTI Act To Larger Bench” (16 February 2026) — https://www.livelaw.in/top-stories/supreme-court-refers-pleas-challenging-dpdp-act-amendment-to-rti-act-to-larger-bench-523266 (accessed 15 October 2026)
Supreme Court Observer, “Challenge to DPDP Act | Day 2: Law may impede investigative journalism, petitioners argue” (7 August 2026) — https://www.scobserver.in/reports/challenge-to-dpdp-act-day-2-law-may-impede-investigative-journalism-petitioners-argue/ (accessed 15 October 2026)

Disclaimer: This article is general information as at 15 October 2026, not legal advice; notifications under the DPDP Act and Rules (transfer restrictions, Significant Data Fiduciaries, Board appointments) may change the position, so verify against current law before acting.

DPDP Act for foreign companies and offshore processors: what India’s Digital Personal Data Protection Act requires and when