India's Data Protection Law Applies to Every Technology Company That Serves Indian Users
Section 3(b) extends the DPDPA to any entity outside India processing personal data in connection with offering goods or services to Data Principals within the territory of India. If your platform has Indian users, you are within scope.
Global technology companies face a unique compliance challenge under the Digital Personal Data Protection Act, 2023. Unlike sector-specific regulations, the DPDPA applies horizontally — every technology company processing personal data of individuals in India is a Data Fiduciary, regardless of where it is incorporated.
The compliance architecture for a technology company differs fundamentally from traditional enterprise compliance. Platform businesses process data at scale, across multiple purposes, through automated systems that make autonomous processing decisions. The DPDPA's consent architecture (Section 6) was designed for deliberate, human-directed processing. Adapting it to algorithmic processing requires structural, not cosmetic, changes to data infrastructure.
Platform Data Architecture Under DPDPA
A global technology platform typically processes personal data across dozens of distinct purposes — user authentication, content personalisation, advertising targeting, analytics, fraud detection, product improvement, and AI model training. Under Section 5, each purpose requires a specific notice. Under Section 6, each purpose requires specific consent. Bundled consent mechanisms — where a single "I agree" covers all processing — are expressly non-compliant.
Multi-purpose consent segregation
Section 6 requires consent to be specific to each purpose. A platform with 12 processing purposes needs 12 separate consent mechanisms.
Algorithmic processing disclosure
If AI systems process personal data for automated decision-making, the notice under Section 5 must disclose this. "We use your data to improve our services" does not satisfy the specificity requirement.
Cross-border data routing
Cloud-native platforms route data across multiple jurisdictions. Section 16 requires mapping every routing path — including CDN nodes, disaster recovery sites, and AI processing clusters — against any restricted-jurisdiction notifications issued under Section 16(1) (none published as of August 2026).
Children's Data: The Section 9 Problem for Platforms
Section 9 prohibits behavioural monitoring and targeted advertising directed at children. For a global platform, this creates an architectural problem: how do you segregate children's data from adult data when your platform does not require age verification at registration? The answer under DPDPA is clear — you cannot process children's data without verifiable parental consent. Rule 10 prescribes the methodology. Platforms that rely on self-declared age face a simple question: what evidence will you present to the Board that your age verification is verifiable?
AI and Automated Processing
Technology companies deploying AI systems that process Indian personal data face layered obligations. The processing must be grounded in consent (Section 6) or a legitimate use (Section 7). The training data must comply with purpose limitation. The outputs must not violate data accuracy obligations. And if the AI system makes decisions that affect the Data Principal, the notice must disclose the automated nature of processing. Significant Data Fiduciaries must additionally conduct algorithmic due diligence under Rule 13.
Key DPDPA Obligations
| Obligation | Section / Rule | Description |
|---|---|---|
| Purpose-specific notice | Section 5 | Every processing purpose disclosed separately with clear language |
| Granular consent architecture | Section 6 | Separate consent for each purpose; no bundled consent |
| Children's data protocols | Section 9, Rule 10 | Verifiable parental consent; no behavioural monitoring of minors |
| Cross-border transfer mapping | Section 16 | Every data routing path verified against restricted jurisdictions |
| Data Processor governance | Section 8(2) | DPAs with every cloud provider, CDN, analytics vendor, sub-processor |
| Breach notification protocol | Section 8(6), Rule 7 | Board and Data Principal notification in prescribed format |
Request a Technology Company DPDPA Compliance Assessment
A confidential assessment of your India data protection exposure — platform architecture, consent mechanisms, cross-border routing, and AI processing compliance mapped against every DPDPA obligation.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
Frequently Asked Questions
Does DPDPA apply to a technology company incorporated outside India?
Yes. Section 3(b) extends the Act to any entity outside India that processes personal data in connection with offering goods or services to Data Principals within the territory of India. If your platform is accessible from India and processes Indian user data, you are within scope.
Can a global technology company use a single consent for all processing purposes?
No. Section 6 requires consent to be specific to each purpose. A single "I agree" covering multiple processing purposes is non-compliant. Each purpose requires separate, informed consent with a clear affirmative action.
What happens if a technology company cannot implement age verification under Section 9?
The obligation under Section 9 is absolute — processing children's data without verifiable parental consent is a contravention attracting penalties under the Schedule. Technology companies must implement age verification mechanisms that satisfy Rule 10 requirements, regardless of technical difficulty.