Does the DPDP Act apply to a startup incorporated outside India?
Yes. Foreign incorporation is not an exemption. If you process digital personal data of Indian users to offer goods or services, the Act applies — no matter where you are registered, how small you are, or how much revenue you make.
Short answer
Section 3(b) of the DPDP Act reaches outside India. This covers:
- A Delaware C-corp offering goods or services to people in India.
- A Singapore Pte. Ltd. doing the same.
- Even a one-person EU SaaS business doing the same.
There is no startup, revenue, turnover, or headcount carve-out.
The detail
Section 3 has two limbs. The first applies to digital personal data processed within India. The second, section 3(b), applies to processing done outside India. This second limb applies if the processing is connected with offering goods or services to Data Principals within India.
That means the law looks at who the data is about and what the activity is for. It does not look at where the company is incorporated. If your product collects, stores, or processes personal data of Indian users as part of offering them goods or services, you are a Data Fiduciary under the Act.
The one nuance readers often confuse is section 17(1)(d). That provision exempts India-based processing of non-Indian data when it is done under a contract with someone outside India. Think of offshore back-office processing of EU customer data. That is the opposite situation: a foreign company serving Indian users is covered, not exempt.
Covered or not? Quick examples
| Scenario | Covered? | Why |
|---|---|---|
| US SaaS with paying customers in India | Yes | Offering services to Indian users |
| EU app with Indian sign-ups and in-app purchases | Yes | Goods/services connected to Indian users |
| Two-person Singapore startup with one Indian freelancer | Yes | No revenue or headcount threshold |
| Indian BPO processing German customer data under contract | Exempt | Section 17(1)(d): non-Indian data, India-based outsourcing |
What this means for you
If Indian users can sign up, buy, or use your product, assume the Act applies. Incorporation in Delaware, Singapore, or the UAE does not shield you. Plan for consent notices, grievance handling, and breach reporting now.
Working for an overseas client whose end users are in India? The client is likely the Data Fiduciary. Your processing must follow their instructions. The contract must also meet the Act's processor requirements.
Running a paid newsletter, course, or merch store that serves Indian subscribers? The DPDP Act applies either way. It covers the personal data you collect for that business purpose, foreign platform or not.
Status
Related pages
Am I a Data Fiduciary?
Run the 3-minute self-check to see whether your product falls inside the DPDP Act's scope.
Run it nowPrimary sources
Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023). See Section 3 for territorial scope.
Status unverified — no status check recorded
G.S.R. 846(E), 13 November 2025. Operational rules on consent, breach response, and complaints.
Status unverified — no status check recorded
Official text — Section 3(b), DPDP Act, 2023
Citation
Kokate, S. (2026). Does the DPDP Act apply to a startup incorporated outside India? India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/does-dpdp-apply-to-foreign-startups. Educational content, not legal advice.
The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.