Yes, the DPDP Act 2023 can apply to companies based outside India. Under Section 3, it covers the processing of digital personal data outside India if that processing is in connection with offering goods or services to Data Principals within India. So an overseas SaaS, e-commerce or app company with Indian users is generally subject to the DPDP Act, even with no Indian office. This checker shows whether you are in scope.
Check the extraterritorial scope of India's DPDP Act 2023 (Section 3) for businesses based outside India.
Section 3 of the DPDP Act 2023 gives the law extraterritorial effect. It applies to processing of digital personal data within India, and to processing outside India where that processing is in connection with any activity related to offering goods or services to Data Principals in India.
In practice, a foreign SaaS platform, online store, mobile app or B2C service with Indian customers is treated as a Data Fiduciary under the Act. Many such companies will need to designate a contact for Indian users and, if classified as Significant Data Fiduciaries, appoint a Data Protection Officer based in India.
A guide for overseas businesses: when DPDP applies, what to set up for Indian users, and the SDF/DPO question.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
