Does India's DPDP Act apply to a foreign company with no physical presence in India?

The DPDP Act's extraterritorial reach means a foreign e-commerce platform, SaaS provider, or any company collecting personal data from individuals in India as part of offering them goods or services falls within scope, even without an Indian subsidiary, branch, or local server. What matters is the connection between the data processing and individuals located in India, not the processor's physical location.

Compliance obligations under the Act include obtaining valid consent before processing personal data, providing clear notice of what data is collected and why, honoring data principal rights (access, correction, erasure), implementing reasonable security safeguards, and reporting personal data breaches to the Data Protection Board. Foreign companies that already comply with GDPR have a head start structurally, since many DPDP requirements echo GDPR concepts, but the two laws aren't identical — consent mechanics, breach notification timelines, and the treatment of children's data all have India-specific requirements that a GDPR compliance program doesn't automatically satisfy.