When Does the DPDP Act Reach a Foreign Company?

Introduction

A US software company has Indian customers, rupee pricing and a subsidiary in Bengaluru. Its general counsel asks: does India's Digital Personal Data Protection Act, 2023 (the DPDP Act) apply to us, which of our companies answers to the Data Protection Board, and do we need a representative in India?

The Act regulates data fiduciaries (who decide why and how personal data is processed) and data processors (who process it on a fiduciary's behalf), for the benefit of data principals (the individuals concerned). It asks not where a company is incorporated but where processing happens and whom the business serves.

Trayambic's GCC study, cross-border transfers article and GDPR comparison cover related ground.

The legal position

Two triggers. Section 3(a) applies the Act to digital personal data processed within India, whoever processes it: a foreign company using an Indian cloud region, Indian staff or an Indian vendor is in scope for that processing. Section 3(b) extends it to processing outside India "in connection with any activity related to offering of goods or services to Data Principals within the territory of India". Section 3(c) excludes personal or domestic processing and data made public by the data principal or under a legal duty. A "person" includes companies and "every artificial juristic person" (s.2(s)), with no carve-out for foreign entities. Section 3 commences on 13 May 2027.

No monitoring limb. Article 3(2) of the GDPR reaches non-EU businesses that offer goods or services to people in the Union or monitor their behaviour there. MeitY's draft Digital Personal Data Protection Bill, 2022 had a counterpart: clause 4(2) covered processing abroad "in connection with any profiling of, or activity of offering goods or services" to data principals in India, profiling being processing that "analyses or predicts aspects concerning the behaviour, attributes or interests" of a person. The Act dropped profiling.

No representative. Article 27 of the GDPR requires a business caught by Article 3(2) to designate in writing a representative in the Union, whom regulators and individuals may address, unless its processing is occasional and low-risk or it is a public authority. The DPDP Act, like its 2022 draft, has no counterpart. Every fiduciary publishes the contact details of a Data Protection Officer (DPO) or another person who can answer questions (s.8(9); Rule 9), with no requirement that the person be in India. Only a Significant Data Fiduciary (SDF), designated by the Central Government on factors such as the volume and sensitivity of its data, must have a DPO "based in India" (s.10(2)(a)).

Other Indian laws do ask for presence. The Consumer Protection (E-Commerce) Rules, 2020 apply to an e-commerce entity "not established in India" that "systematically offers goods or services to consumers in India" (rule 2(2)) and require a nodal person "resident in India" (rule 4(1)(b)). Significant social media intermediaries need three officers resident in India and a physical address in India (IT Rules, 2021, rules 4(1), 4(5)).

Enforcement tools, all commencing on 13 May 2027:

• Inquiry. The Board has a civil court's powers to summon people and require documents (s.28(7)), and works as a digital office (s.28(1)).
• Information calls. The Central Government may, "for the purposes of this Act", require any fiduciary or intermediary to furnish information (s.36). Rule 23 and the Seventh Schedule set out three purposes: State processing for sovereignty, integrity or security; State functions or disclosure duties under law; and assessing SDF designation. The Government may forbid disclosure that information was furnished where that could harm sovereignty, integrity or security (Rule 23(2)).
• Blocking. If the Board has penalised a fiduciary in two or more instances, it may refer the case to the Central Government, which after a hearing may direct any agency or intermediary to block public access to information in a computer resource that "enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals" in India (s.37(1)). Intermediaries must comply (s.37(2)).

Trade law. The digital trade chapter of the India–UK Comprehensive Economic and Trade Agreement, in force since 15 July 2026, has no binding data-flow or localisation commitment, only future consultations (Article 12.20) and a five-year review (Article 12.21). UK companies gain no exemption.

Analysis

Reading "offering" in section 3(b)

The Act does not define offering. Recital 23 of the GDPR says mere accessibility of a website is not enough; a local language or currency, or mention of local customers, can show an intention to offer. In our view Indian authorities will ask similar questions: rupee pricing, UPI or Indian cards, an Indian app-store listing, Indian-language screens, delivery to Indian addresses.

• Location, not nationality. "Within the territory of India" is a location test. An Indian using a foreign app while abroad is outside s.3(b); a tourist in India using an app aimed at India is inside.
• Wide connecting words. "In connection with any activity related to" stretches beyond the business doing the offering. In our view a foreign processor that hosts, analyses or serves advertising for an India-facing service is caught, though its duties reach it mainly through the fiduciary's contract (s.8(1), 8(2)).
• What stays outside. Without a monitoring limb, a foreign business that profiles people in India without offering them anything, such as a people-search service sold to foreign clients or a research project abroad, is in our view outside s.3(b) unless it processes in India. The 2022 draft would have caught it. A foreign parent's processing of its Indian staff's data is arguably outside too, as Trayambic's GCC study notes, because employment is not obviously an offering.

No representative, but some presence

A foreign fiduciary needs no Indian company, branch or representative. It does need an Indian-facing operation: a published contact, grievances answered within 90 days (s.13; Rule 14), breach notices to Indian users and the Board (s.8(6); Rule 7), and consent requests available in English or an Eighth Schedule language (s.6(3)).

Presence becomes mandatory in three cases: SDF designation (an India-based DPO, an independent data auditor and possibly keeping specified data in India under Rule 13(4)); acting as a consent manager, which must be a company incorporated in India (Rule 4; First Schedule); and the e-commerce or social media rules above.

Indian subsidiaries: fiduciary, processor or neither

Roles follow facts. A fiduciary is whoever "alone or in conjunction with other persons" decides the purpose and means of processing (s.2(i)). An Indian subsidiary can be:

• the parent's processor, for support or engineering on Indian users' data, under a s.8(2) contract, with the parent answerable (s.8(1));
• a fiduciary, for its own staff, local campaigns it designs, or consumers it serves in its own name;
• an exempt processor, for foreign users' data handled in India under its intra-group agreement with the foreign parent, where s.17(1)(d) removes most duties but not ss.8(1) and 8(5) (see the GCC study).

The Act has no establishment test like Article 3(1) of the GDPR. In our view, therefore, owning an Indian subsidiary does not by itself bring the parent's worldwide processing within the Act, and the subsidiary, a separate person, does not answer for the parent's breaches, though the Board can summon its officers and records.

Enforcement at a distance

The Board can inquire into a foreign fiduciary like any other. We find no provision on recovering a penalty from a company with no assets in India. The sanction for repeat cases is s.37, which borrows the language of s.3(b): after penalties in two or more instances, the Government may have intermediaries block public access to the fiduciary's India-facing service.

Rule 23 requests may reach the Indian subsidiary first. In our view it should answer only for what it holds, route the rest to the fiduciary under an agreed protocol, and respect any non-disclosure direction. Transfers from subsidiary to parent are allowed unless a country is notified under s.16; Trayambic's cross-border transfers article covers the limits.

Practical implications

Worked example (illustrative). A US company sells AI meeting-notes software. It has 5 lakh Indian individual users on a freemium plan billed in rupees through UPI, and 200 Indian enterprise customers that contract with its Bengaluru subsidiary, which resells the service. The subsidiary's 300 staff provide engineering and support on global data hosted in the United States.

1. 1.Individual users. Rupee billing, UPI and an Indian app listing show an offering to people in India, so the parent's US processing is within s.3(b) and the parent is the fiduciary. It needs Rule 3 notices, consent before using recordings for AI training, an age screen, and an India branch in its breach plan.
2. 2.Support. Bengaluru staff handling Indian users' tickets process data in India (s.3(a)) as the parent's processor, under a written contract.
3. 3.Enterprise customers. Each customer is the fiduciary for its employees' meeting data; the subsidiary is its processor and the parent a sub-processor. Contracts flow down incident notice within hours and erasure on exit.
4. 4.Global data. Bengaluru's work on American and European users' data falls under s.17(1)(d), through the intra-group contract. Security safeguards still apply.
5. 5.Contact. The parent names the subsidiary's privacy lead as its published contact. No representative is needed unless the parent is designated an SDF, when a DPO based in India becomes mandatory.
6. 6.Readiness. Board notices and information calls may arrive in Bengaluru, so a protocol routes them to the parent's counsel within a day. After a first penalty, management treats a second as a possible trigger for blocking the Indian service, including the subsidiary's resale business.

Scope checklist for foreign businesses

Key takeaways

The DPDP Act follows the data and the customer, not the corporate address. A foreign company that processes in India or offers to people in India owes an Indian fiduciary's duties, without a representative. Its subsidiary's role depends on who decides purposes, and repeat breaches risk blocking.

• The DPDP Act applies to processing in India by anyone (s.3(a)) and to processing abroad connected with offering goods or services to people in India (s.3(b)).
• Unlike GDPR Art. 3(2)(b) and MeitY's 2022 draft, the Act has no monitoring or profiling trigger, so in our view profiling without an offering to people in India falls outside s.3(b).
• There is no GDPR Art. 27-style representative; only Significant Data Fiduciaries need a DPO based in India, though e-commerce and social media rules require residents in India.
• An Indian subsidiary may be a processor, a fiduciary or an exempt processor under s.17(1)(d); in our view owning one does not bring the parent's worldwide processing within the Act.
• From 13 May 2027 the Board can inquire into foreign fiduciaries, and after penalties in two or more instances the Centre can block access to their India-facing services (s.37).