Does India’s DPDP Act apply to your foreign app or SaaS?

Are you a founder of a Delaware C-corp processing information about people in India on US servers? Server location is a fact, but it is not the whole scope test. The company’s formation state alone does not decide whether India’s privacy law applies.

Status checked 13 November 2026: The Act and Rules have staged commencement. The main provisions discussed here are scheduled for the eighteen-month stage from Gazette publication, rather than all being in force today. The Rules Gazette issue is dated 13 November 2025, while MeitY’s official listing shows 14 November 2025. Because these official records display different dates, this article does not treat a specific calendar date as settled. Confirm the authoritative publication date before using a date for a compliance calendar. Sources: Read the commencement notification; the consolidated Act annotation

DPDP means Digital Personal Data Protection. The Digital Personal Data Protection Act, 2023 (DPDP Act) regulates certain processing of digital personal data. “Personal data” means information about an individual who is identifiable by or in relation to that information. “Processing” covers operations such as collecting, storing, using, sharing, or deleting data. See sections 2 and 3 of the Act.

The territorial test in plain English

The territorial test asks which country’s law can apply to the data activity. A company’s address or the server’s location can be relevant facts, but neither answers the whole question by itself.

Section 3 has two main routes. First, the Act applies to digital personal data processed within India when it was collected in digital form or collected offline and later digitised. Second, it can apply to processing outside India when that processing is connected with an activity related to offering goods or services to Data Principals in India. A Data Principal is the individual to whom the personal data relates. The text does not make “a website can be opened in India” the complete test, nor does it state that having no Indian office is an automatic exemption. Read section 3.

For an overseas product, record facts that help explain the connection: who the service is offered to, how users are onboarded, what the contract says, what the product does for those users, and where the processing occurs. A single Indian visitor, an India-directed service, and a product with an established Indian customer base are different factual situations. The statute should be applied to the actual circumstances, not a traffic metric alone.

What “digital personal data” looks like in a product

It can be more than a name or email address. An account ID linked to a person, a support conversation, an identifiable device record, a payment profile, or a location history may relate to an identifiable individual. A set of details can also identify someone when combined, even if no single field shows a full name. The product team should describe what data the system actually handles rather than using a label like “anonymous analytics” without checking whether the person can be identified.

A foreign product example

Imagine a US-based project app that has a public website anyone can open. That fact alone does not tell the company whether section 3(b) applies. Now add evidence that the company sells paid accounts to Indian businesses, provides onboarding for those accounts, and processes their staff’s profile and activity information on US servers. Those facts create a closer question about processing connected with offering services to Data Principals in India. The statute still needs to be applied to the full circumstances. The right answer is not “US servers mean no Indian law” or “one Indian page view proves everything.”

What the role labels mean

The person whose information is processed is called the Data Principal. The organisation that decides why and how data is processed is the Data Fiduciary. A Data Processor processes data for the Fiduciary. For example, a company may decide to collect account details to operate its own app, while a cloud host stores those details under the company’s instructions. Contracts help show the relationship, but teams should also check who actually makes decisions in the product.

Which company has which role?

A Data Fiduciary is the person who, alone or with others, decides the purpose and means of processing. A Data Processor processes personal data on behalf of a Data Fiduciary. A SaaS company can act as a Processor for one workflow and make its own decisions as a Fiduciary in another. Look at each processing purpose, not just the company’s title or privacy-policy label.

For a dApp, or decentralised application, examine who actually decides the purpose and means, who can change the system, who controls interfaces or keys, and who receives or uses data. The “decentralised” label is not an automatic exclusion. It may make the role analysis more fact-sensitive.

What to map before reaching a conclusion

– Indian user journeys, customer contracts, and the service being offered.

– Personal data collected, including account, support, device, and payment information.

– Which legal entity decides each purpose and which vendors act on its instructions.

– Where data is accessed, stored, backed up, and deleted.

– Any applicable statutory exemption or government notification.

Frequently asked questions

Does having no Indian office keep a foreign company outside the Act?

No automatic exclusion follows from having no Indian office. Section 3(b) can apply to processing outside India when it is connected with an activity related to offering goods or services to Data Principals in India. Assess the real service and processing facts.

Does one Indian user automatically mean the Act applies to everything?

The Act does not set a simple user-count threshold in section 3. Review how the service is offered, what data is processed, and the connection with the person in India. Keep the scope conclusion tied to evidence.

Does using a US cloud provider decide the issue?

No. Server location is one part of the map. It does not answer whether the statutory territorial test applies or which organisation decides each processing purpose.

Is the app company always the Data Fiduciary?

Not automatically for every activity. A company may be a Fiduciary for purposes it decides and a Processor for work it does only for a customer. Map the activity one purpose at a time.

The Act excludes certain processing, including personal data processed by an individual for a personal or domestic purpose and data made publicly available in the circumstances stated in section 3. Section 17 also contains exemptions. Do not assume an exemption without checking its exact conditions.

The DPDP Act and Rules have phased commencement. The business-facing provisions are scheduled for the later stage described in the official commencement notification. That timeline affects when particular duties commence; it does not replace the scope analysis. See the commencement notification.

This is a general explainer, not a conclusion about a particular foreign product. The relevant data, service, entities, and current notifications all matter.

Related reading: A DPDP review for apps that already have Indian users; the DPDP commencement timeline and who each stage concerns; a SaaS readiness roadmap.

Primary sources: DPDP Act, 2023, sections 2 and 3; DPDP Rules, 2025, as corrected by the official corrigendum; commencement notification G.S.R. 843(E).

This article is for general awareness and is not legal advice. Laws change and every matter turns on its facts — please seek independent counsel before acting on it.