DPDP Act 2023 Compliance for Foreign-Owned Indian Subsidiaries

The Digital Personal Data Protection Act, 2023 (DPDP Act) is moving from statute to enforcement, with rules notified and compliance deadlines now on the calendar. Foreign companies running an Indian subsidiary, a GCC, or a BPO/ITES operation that touches employee or customer personal data are Data Fiduciaries under the Act whether or not anyone on the HQ privacy team has registered that fact, and the obligations attach to the Indian entity directly, not to whatever privacy policy the parent already publishes.

The core obligations are specific: explicit, itemised consent rather than one buried in generic terms and conditions, purpose limitation so data collected for one stated reason can't quietly be reused for another, data minimisation, breach notification to the Data Protection Board and affected individuals within prescribed timelines, and a working grievance redressal mechanism. For subsidiaries processing employee data, payroll, biometric attendance, performance records, the employer-employee relationship is not an exemption. DPDP treats employee data as personal data too, with a narrower but real set of obligations attached to it.

Entities notified as Significant Data Fiduciaries, a designation based on the volume and sensitivity of data processed and the risk to sovereignty, electoral integrity, or public order, face additional obligations: an India-based Data Protection Officer, independent data audits, and periodic data protection impact assessments. Many GCCs processing data at scale on behalf of a foreign parent's global customer base are plausible SDF candidates once thresholds are formally notified, which makes this a plan-now item rather than a wait-and-see one.

On cross-border transfer, the DPDP Act takes a different approach than GDPR's adequacy-list model: by default, personal data can move out of India except to countries the government specifically restricts, a blacklist rather than a whitelist. That is, in practice, more permissive for routine parent-subsidiary data flows than many foreign privacy teams assume going in. It is not, however, the last word. Sector-specific rules, RBI's data localisation requirements for payment data being the clearest example, can still override DPDP's default and require data to stay on Indian soil regardless.

The practical starting point: map exactly what personal data your India subsidiary actually touches, HR records, customer data, vendor data, build consent and notice language specific to the DPDP Act rather than retrofitting a GDPR template, and don't assume a global privacy policy automatically satisfies Indian obligations. It doesn't. With penalties running up to INR 250 crore per instance for significant breaches, this is one of the more expensive places to get wrong by assumption rather than by design.