India's DPDP Act Extraterritorial Scope: What Global Organizations Need to Know

"If we do not have a physical presence in India, are we still within scope?"

The answer depends on the nature of your relationship with individuals in India.

The DPDP Act applies to the processing of digital personal data outside India when that processing is connected with offering goods or services to individuals located in the country. In simple terms, the regulation follows the data relationship rather than the physical location of the organization.

A company does not necessarily need an office, employees or data centres in India to potentially fall within the scope of the Act.

Practical Examples of DPDP’s Extraterritorial Applicability

Scenario 1:

Imagine an American digital health technology company. The organization has no office in India. Its employees are located across the US, and its technology infrastructure operates entirely outside India. However, the company actively markets its services to users in India, accepts subscriptions from Indian customers and processes their personal data.

The deciding factor is that the organization has established a service relationship with individuals whose data is being processed in India.

Scenario 2:

Consider a Singapore-based cloud platform that provides services to a multinational company with significant customer base in India. If the cloud provider processes personal data belonging to individuals in India on behalf of its customer, it may act as a Data Processor under DPDP.

For technology providers, this highlights an important point: privacy responsibilities are not limited to organizations that directly interact with consumers. Vendors and service providers supporting those organizations also need to understand their role in the data ecosystem.

Responsibilities of Data Fiduciary and Data Processor

Before making compliance decisions, organizations should first understand their role under the DPDP framework. This is often the starting point for determining what obligations apply.

Data Fiduciary

A Data Fiduciary is the organization that determines why and how personal data is processed. Many organizations will fall into this category when they directly collect and use personal data from customers.

Examples include:

• Digital platforms collecting customer information
• Financial institutions managing customer records
• Healthcare organizations handling patient information

Data Processor

A Data Processor handles personal data on behalf of a Data Fiduciary.

Common examples include:

• Cloud service providers
• Managed service providers
• Customer relationship platforms
• Outsourced technology partners

For organizations operating globally, understanding this distinction helps clarify accountability and the controls required across the data processing chain.

A Practical DPDP Compliance Roadmap for Global Organizations

The good news is that DPDP readiness does not require most organizations to start from zero. Most companies with established privacy and governance programs already have many of the building blocks required.

The focus should ideally be on understanding current practices, identifying gaps and strengthening specific areas where DPDP requirements apply.

Here are four areas organizations should prioritize:

1. Build Visibility Through Data Mapping and Discovery

The first step is understanding where Indian personal data exists across your environment.

Organizations should identify:

• Where personal data enters the ecosystem
• Which applications process it
• Where it is stored
• Who has access to it
• Which third parties are involved

Many organizations discover during this exercise that data flows are more complex than expected. A reliable data inventory becomes the foundation for regulatory readiness.

2. Review Consent and Privacy Communication Practices

Consent is one of the most visible ways individuals interact with privacy programs. Organizations should review whether their current processes provide:

• Clear information about data usage
• Meaningful consent choices
• Simple withdrawal mechanisms
• Transparent privacy notices

The goal is not just meeting a legal requirement but to create a privacy experience that individuals will understand and trust.

3. Strengthen Vendor and Third-Party Governance

Modern businesses rarely operate alone. Customer data often moves through a network of technology providers, cloud platforms and service partners. Organizations should review vendor agreements and Data Processing Agreements (DPAs) to ensure appropriate requirements exist around:

• Security safeguards
• Data handling responsibilities
• Processing limitations
• Retention and deletion
• Incident notification

Third-party visibility is especially important because compliance risk can extend across the entire data processing ecosystem.

4. Align Incident Response and Security Operations

A privacy incident is also a business risk. Organizations should ensure their incident response processes consider privacy obligations from the beginning.

This includes reviewing:

• Detection and monitoring capabilities
• Internal escalation procedures
• Regulatory reporting workflows
• Roles and responsibilities during incidents

Organizations that already follow frameworks such as ISO 27001, SOC 2 or NIST-based security practices can often leverage these existing controls as part of their DPDP readiness journey.

What Should Organizational Leaders Focus On?

DPDP should be viewed as an opportunity to strengthen existing governance rather than another isolated compliance exercise.

The key questions to ask are:

• Do we know where Indian personal data exists across our environment?
• Do we understand our role as a Data Fiduciary or Data Processor?
• Are our vendors aligned with our privacy expectations?
• Can our security processes support privacy obligations?
• Are team members aware of their responsibilities?

Answering these questions provides a practical starting point for building a sustainable compliance approach. A comprehensive DPDP readiness assessment can be a helpful exercise.

Conclusion

The key takeaway is simple: in today’s connected digital economy, privacy obligations increasingly follow the individual whose data is being processed, not the physical location of the organization handling that data.

A company may operate from one country, rely on technology infrastructure across multiple regions and serve customers around the world. Privacy programs must evolve to reflect this reality by providing control across the entire data ecosystem.

Organizations that take a proactive approach today will not only reduce regulatory risk but also build greater trust with customers in one of the world’s fastest-growing digital markets.