Data protection compliance in India is an important consideration for international companies serving Indian customers, employing local staff, establishing Indian subsidiaries or using Indian service providers. As business operations become increasingly digital, organisations must understand how Indian privacy laws interact with their existing global compliance programmes. A policy designed for Europe or the United States may provide a useful starting point, but it does not automatically satisfy Indian legal requirements. India’s Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025, introduces a dedicated framework for processing digital personal data. International businesses should assess its territorial scope, consent requirements, security obligations, cross border transfers and phased implementation timeline. Early preparation can reduce legal uncertainty and help organisations maintain consistent privacy standards across jurisdictions.

Does Indian Data Protection Law Apply to Foreign Companies?

The DPDP Act applies to digital personal data processed within India. It can also apply to processing outside India when the processing is connected with offering goods or services to individuals in India. A foreign company does not necessarily need a physical office in the country for its activities to fall within the Act’s scope. For example, an overseas ecommerce platform selling directly to Indian customers, a global application collecting information from users in India or an international company processing Indian customer records through a central database may need to assess its obligations under the Indian framework. The precise position depends on the activities and circumstances involved. The Act generally covers personal data in digital form, including information collected offline and subsequently digitised. Purely offline personal data which is never digitised falls outside its scope, subject to the Act’s provisions and other applicable laws. Businesses should therefore map their data processing activities rather than assume every operation is covered in the same way.

Understanding India’s DPDP Act and Rules

The DPDP Act establishes obligations for Data Fiduciaries, the entities which determine the purpose and means of processing personal data. Data Processors handle personal data on behalf of a Data Fiduciary. An international group may occupy different roles across its operations, so these roles should be assessed for each processing activity. The framework addresses transparency, consent, specified legitimate uses, reasonable security safeguards, personal data breach notifications and individual rights. It also provides for enhanced responsibilities for Significant Data Fiduciaries and financial penalties for specified breaches.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025. However, implementation is phased. As of October 2026, businesses must distinguish provisions already in force from substantive operational requirements scheduled to commence in May 2027. The Government of India’s official explanation of the DPDP Rules provides background on the framework and its implementation. International companies should maintain a commencement tracker and assign responsibility for preparing each requirement. Treating every provision as already operational may create confusion, while waiting until the final implementation date can leave insufficient time for system and contract changes.

Key Compliance Obligations for International Businesses

1. Review Consent and Privacy Notices

A central compliance task is to ensure personal data is collected and used under a valid basis recognised by the Indian framework. Consent is important, but the Act also recognises specified legitimate uses. Companies should not assume the broader lawful bases available under other privacy laws automatically justify processing in India. Privacy notices should explain the personal data being collected and the purposes for which it will be used in clear, accessible language. Businesses should review website forms, mobile applications, employee notices, marketing subscriptions and customer onboarding processes. Where consent is relied upon, the organisation should maintain a reliable record and provide appropriate mechanisms for managing or withdrawing it.

2. Protect Customer and Employee Data

International businesses often process Indian customer information, recruitment records, payroll details and employee performance data through shared global systems. Access should be limited to people who need the information for authorised purposes, and appropriate safeguards should be applied to storage, transmission and use. Practical measures include access controls, encryption where appropriate, secure authentication, monitoring, backup arrangements and staff training. Organisations should also review how personal information is used by analytics platforms, artificial intelligence tools and external service providers. A global security certification may support a compliance programme, but it does not by itself establish compliance with Indian law. Companies need to assess their actual processing activities, applicable legal obligations and the effectiveness of their controls.

3. Prepare for Personal Data Breaches

A data breach can trigger legal, regulatory, contractual and reputational consequences. International groups should establish a response process covering detection, containment, evidence preservation, impact assessment, internal escalation and required notifications. Indian requirements must be assessed alongside other applicable reporting duties. CERT In directions, for example, require specified cyber incidents to be reported within six hours of noticing them or being informed of them, for entities and incidents within scope. The DPDP framework introduces separate personal data breach obligations, with substantive operational provisions subject to phased commencement. A multinational company may also have contractual duties to notify a global customer or parent company within a shorter period. A single incident response plan should identify each applicable deadline, responsible decision maker and reporting channel.

4. Manage Cross Border Data Transfers

International companies frequently transfer personal data between India, regional offices, global headquarters and cloud service providers. The DPDP Act does not impose a universal requirement to store all personal data in India. Instead, Section 16 provides a framework under which the Central Government may restrict transfers to specified countries or territories, while preserving stricter requirements under other applicable Indian laws. This means companies must assess the relevant transfer restrictions rather than assume either unrestricted transfers or blanket localisation. Sector specific requirements, contractual commitments and foreign privacy laws may impose additional conditions. For example, regulated financial services may have separate rules governing particular records or systems. A transfer review should identify the data involved, recipient entities, processing purpose, storage locations, onward transfers and applicable restrictions. Contracts and vendor assessments should reflect the findings.

5. Review Vendor and Intra Group Agreements

A multinational group may share services across several jurisdictions, including human resources, customer support, finance, cybersecurity and cloud hosting. These arrangements need clear documentation of each party’s responsibilities and the permitted use of personal data. Legal and procurement teams should review confidentiality obligations, security measures, incident notification, subcontracting, access controls, data retention, deletion and cooperation with regulatory requests. Intra group data sharing should be assessed with the same care as transfers to external suppliers. Companies seeking advice from data protection advocates can use legal reviews to identify gaps between their existing global contracts and Indian requirements. The objective is to establish enforceable responsibilities and workable processes, not merely add generic privacy clauses to every agreement.

DPDP Act and GDPR: Why One Global Policy May Not Be Enough

Companies already complying with the European Union’s General Data Protection Regulation may have mature privacy notices, records of processing, security controls and vendor management procedures. These resources can help with Indian compliance, but the two regimes are not interchangeable. The GDPR provides several lawful bases for processing, including legitimate interests, while the DPDP Act uses consent and specified legitimate uses within its own framework. The laws also differ in their treatment of territorial scope, individual rights, children’s data, organisational duties and international transfers.

For example, the DPDP Act generally treats a child as an individual under 18 and establishes specific requirements for processing children’s personal data, subject to applicable statutory exceptions and exemptions. A global platform designed around a different age threshold may need to review its Indian user journey. International businesses should maintain a common global privacy standard where practical, supported by a country specific assessment for India. This approach preserves consistency while allowing local legal requirements to be addressed accurately.

Practical Steps for Building an India Compliance Programme

A useful starting point is a data inventory covering customer, employee, supplier and website information. The business should identify which legal entities determine processing purposes, which service providers process data, where information moves and which retention periods apply.The next step is a gap assessment against current Indian obligations and requirements scheduled for future commencement. Findings should be converted into a prioritised plan covering notices, consent processes, security controls, contracts, individual request handling and incident response. Ownership should be assigned to legal, compliance, IT, HR and procurement teams. Businesses should also maintain records of decisions, conduct periodic vendor reviews, train relevant staff and test incident response procedures. Working with a corporate law firm may help international groups coordinate Indian privacy requirements with technology contracts, commercial arrangements, cybersecurity obligations and wider corporate governance.

Conclusion

Data protection compliance in India requires international companies to understand how their operations, data flows and existing global policies interact with Indian law. The DPDP Act and Rules create a distinct framework, so organisations should not assume GDPR compliance alone is sufficient or presume all personal data must be stored locally.By mapping data, reviewing notices and contracts, assessing cross border transfers, strengthening security and preparing for phased implementation, international businesses can reduce legal uncertainty and improve operational readiness. Regular legal and technical reviews will help ensure their privacy programme remains aligned with changing business activities and applicable requirements.

Frequently Asked Questions (FAQs)

Q1. Does the DPDP Act apply to foreign companies without an office in India?

It may. The Act can apply to processing outside India when it is connected with offering goods or services to individuals in India. Applicability depends on the company’s activities and the statutory scope.

Q2. Is GDPR compliance enough for operating in India?

No. GDPR compliance can provide a strong foundation, but India has distinct rules on lawful processing, notices, children’s data, individual rights and other obligations. Businesses should conduct a separate Indian compliance assessment.

Q3. Does India require all personal data to be stored within the country?

No. The DPDP Act does not create a blanket localisation requirement for all personal data. However, government restrictions, sector specific rules and other applicable laws may limit particular transfers or require certain records to be stored locally.

Q4. When do the main DPDP compliance requirements commence?

The framework has a phased commencement schedule. Many substantive operational requirements are scheduled to commence in May 2027. Businesses should check the official notifications and identify the effective date of each provision relevant to their operations.

Q5. What penalties can apply for DPDP Act violations?

The Act provides for financial penalties depending on the type of contravention. The maximum penalty for failure to take reasonable security safeguards to prevent a personal data breach can reach ₹250 crore. The applicable provision and circumstances determine the potential exposure.

Q6. What should an international company do first to prepare for Indian data protection compliance?

It should map personal data, assess whether the Act applies, identify current and upcoming obligations, review privacy notices and vendor agreements, assess cross border transfers, and establish a documented breach response process. A prioritised implementation plan can then address identified gaps.

This update was released on 21 Oct 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.