India’s Digital Personal Data Protection Act, 2023 and the Rules made under it apply to foreign businesses that process the personal data of individuals in India in connection with offering them goods or services. We help international companies map their existing GDPR or other privacy programmes onto Indian requirements, and build what is missing.
What we advise on
- Applicability assessments for foreign businesses and Indian subsidiaries
- Gap assessments between GDPR and the DPDP framework
- Notices, consent flows and consent manager arrangements
- Cross-border transfer of personal data and sector-specific localisation rules
- Data processing agreements with Indian vendors and group companies
- Breach response, including reporting to the Data Protection Board and CERT-In
- Children’s data, significant data fiduciary obligations and audits
- Governance of AI tools that process personal data
Key law and regulation
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Information Technology Act, 2000 and rules under it. CERT-In directions on cyber incident reporting. Sectoral rules of the RBI, SEBI and IRDAI.
Frequently asked questions
Does the Indian law apply to a company with no Indian entity?
It can. The Act applies to processing outside India if it is connected with offering goods or services to individuals in India. Having no Indian entity does not, by itself, take a business outside its scope.
If we are GDPR compliant, are we DPDP compliant?
Not automatically. The frameworks differ on lawful grounds for processing, consent requirements, children’s data, breach reporting and the rights of individuals. A gap assessment usually shows a manageable but real list of changes.
Can personal data be transferred out of India?
The Act permits transfers except to countries the government restricts by notification. Sector regulators, notably for payments data, impose their own localisation rules, which continue to apply.