DPDP Act Compliance for Global Companies Serving India

Does this apply to us if we have no office in India?

Yes, if you're processing the personal data of people in India. The Act's scope provision reaches processing of digital personal data within India, and - separately - processing outside India where it's in connection with offering goods or services to people in India. That second limb is the one global companies miss: a SaaS product with Indian users, or a vendor processing Indian customer data on behalf of an Indian client, is in scope regardless of where the company itself is incorporated.

This is the same extraterritorial logic that made GDPR a global compliance program rather than a purely European one, and most privacy teams that have already built a GDPR program will recognize the pattern immediately.

What counts as being in scope

Two common scenarios bring a global company into scope: collecting data directly from Indian users (a signup form, an app, an account), or processing Indian personal data as a sub-processor or vendor for an Indian client (a cloud provider, an analytics platform, a customer-support tool). Both are "processing" under the Act, and both carry obligations - though an Indian client acting as the primary Data Fiduciary will typically push specific contractual requirements down to you as their processor.

The phased timeline - three dates, not one

The DPDP Rules were notified on November 13, 2025, and don't take effect all at once.

• November 13, 2025 (already in force): the Data Protection Board of India is established, and the rules governing its own procedure take effect.
• November 13, 2026: Consent Manager provisions take effect - a registered-intermediary framework for managing consent that has no direct GDPR equivalent.
• May 13, 2027: most substantive obligations take effect - notice, consent mechanics, security safeguards, breach reporting and data-principal rights.

Could a global company become a "Significant Data Fiduciary"?

Significant Data Fiduciary (SDF) status is assigned by the government based on factors like the volume and sensitivity of personal data processed and the risk to data principals - not company size, revenue or nationality. A global platform with a large Indian user base could plausibly cross that threshold, which brings heavier obligations: a India-based Data Protection Officer, Data Protection Impact Assessments, and periodic independent audits.

Cross-border data transfer: a different model from GDPR

GDPR uses an "adequacy" allow-list model - data can only leave the EU to a country the EU has approved, or under specific safeguards. The DPDP Act takes the opposite structural approach: transfer out of India is permitted by default, except to countries or territories the government specifically notifies as restricted. In practice this means the compliance question for a global company isn't usually "can we receive this data at all" the way it can be under GDPR - it's "has India restricted transfers to our jurisdiction," which is worth checking rather than assuming.

Breach notification: two stages, and it's not GDPR's 72 hours in the same shape

Under Rule 7 of the DPDP Rules (effective May 13, 2027), a personal data breach triggers an initial notice to the Data Protection Board "without delay," followed by a more detailed report within 72 hours covering the breach's nature, extent, timing and likely impact. That's a similar-sounding 72-hour figure to GDPR, but it's structured as a second-stage detailed report rather than GDPR's single 72-hour clock to the supervisory authority - and the specific timing for notifying affected individuals is less uniformly described across available guidance than the Board-notification timeline is. Check the gazetted Rule 7 text directly against your specific scenario rather than assuming your GDPR breach playbook maps over exactly.

DPDP vs GDPR: what carries over, and what doesn't

• Carries over: extraterritorial reach, consent as a core lawful basis, data-principal rights (access, correction, erasure, grievance redress) that closely mirror GDPR's data-subject rights.
• Doesn't carry over: the Consent Manager framework - a registered intermediary model with no GDPR equivalent. DPDP's lawful-basis menu is narrower than GDPR's six bases - consent and a defined set of "legitimate uses" do most of the work, without a broad general-purpose "legitimate interest" basis in the same form.
• Penalties differ structurally too: DPDP sets penalties up to ₹250 crore per instance, adjudicated by the Data Protection Board, rather than GDPR's percentage-of-global-turnover model.

What to actually do now, ahead of May 2027

• Map what personal data of people in India you already hold or process, directly or through sub-processors.
• Review contracts with Indian customers and partners for DPDP-specific clauses - these often arrive well before the legal deadline.
• Assess your realistic exposure to Significant Data Fiduciary classification given your Indian user base or processing volume.
• Start consent and notice-flow redesign work now - it's a multi-month technical and process project, not a policy update.