Section 3 of the Digital Personal Data Protection Act, 2023 defines two categories of applicability. Section 3(a) covers processing of digital personal data within the territory of India. Section 3(b) extends the Act to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India.
This is not a theoretical extension. It is a statutory fact with operational consequences for every multinational corporation that serves Indian customers, employs Indian residents, or processes data originating from India.
The three triggers that bring you within scope
The first trigger is commercial activity directed at India. If your website accepts Indian payment methods, displays prices in Indian Rupees, or targets Indian users through localised content, Section 3(b) applies. The test is not where the server sits. It is whether the activity is connected to offering goods or services to persons in India.
The second trigger is monitoring behaviour of Data Principals in India. Analytics, tracking, profiling, and behavioural advertising directed at Indian users constitute processing under Section 2(x). This includes cookie-based tracking, device fingerprinting, and algorithmic recommendation engines that process Indian user data.
The third trigger is contractual processing on behalf of an Indian Data Fiduciary. If you are a Data Processor under Section 2(k) providing services to an Indian entity — cloud hosting, payroll processing, CRM services, analytics — the obligations under Section 8(2) apply to you regardless of where you are incorporated.
What obligations attach to foreign entities
Every obligation that applies to a domestic Data Fiduciary applies equally to a foreign entity brought within scope by Section 3(b). This includes:
- Notice under Section 5: You must provide a notice to the Data Principal before or at the time of collection, specifying every purpose for which data will be processed and the manner of exercising rights.
- Consent under Section 6: Consent must be free, specific, informed, unconditional, unambiguous, and accompanied by an affirmative action. Pre-ticked boxes, bundled consent, and consent walls are prohibited.
- Breach notification under Section 8(6): You must intimate the Data Protection Board of India and each affected Data Principal without delay. Rule 7 prescribes the format and content.
- Data Principal rights under Sections 11–14: Indian Data Principals can exercise rights of access, correction, erasure, and grievance redressal against you — regardless of where you are incorporated.
The representative obligation question
Unlike the GDPR, which mandates appointment of a representative within the EU for non-EU controllers (Article 27), the DPDPA does not contain an explicit representative requirement for foreign entities. However, Section 10(2)(a) requires every Significant Data Fiduciary to appoint a Data Protection Officer who is based in India. If a foreign entity crosses the threshold for SDF designation, this obligation becomes operative.
For entities below the SDF threshold, the absence of a mandatory representative does not reduce the obligation. It increases the enforcement risk. Without a designated point of contact in India, the Data Protection Board may proceed ex parte under Section 28 — with the foreign entity absent and unrepresented.
"The statute does not care where you are incorporated. It cares where the Data Principal is located. If that location is India, the DPDPA follows the data."
— Anandaday Misshra
Immediate action items for foreign entities
First, conduct a jurisdictional exposure mapping. Identify every data flow that involves personal data of individuals in India — customer data, employee data, vendor data, analytics data.
Second, assess whether your processing falls within Section 3(b) by mapping each data flow against the three triggers above. Document this assessment — it will be your first line of defence if the Board initiates inquiry.
Third, designate an internal India compliance owner. Even without a statutory representative obligation, operational reality demands a person who understands DPDPA, monitors Indian regulatory developments, and can respond to Board inquiries and Data Principal grievances within the prescribed timelines.