§ For foreign digital platforms
If you sell digital services to people in India, or hold their personal data, India's data protection law (DPDP) and its GST rules for online services (OIDAR) apply to you — wherever you are headquartered. We tell you exactly where you stand, and fix what needs fixing.
DPDP duties from 13 May 202718% IGST · no thresholdIndia & New York
§ 1 — The two laws
GST · OIDAR
DPDP Act, 2023
§ 2 — Who it's for
Most of our clients in this work are headquartered in the US, the UK, the EU, Singapore, the UAE, Australia or Canada.
Credit packs and subscriptions sold to people in India are online services taxed under OIDAR. Prompts, uploads and outputs tied to an account are personal data under DPDP.
Premium tiers, paid features and fiat on-ramps can be OIDAR supplies. Wallet-linked profiles, KYC records and IP logs are personal data.
In-app purchases, tips and paid badges are digital supplies. The media, messages and location data of Indian users fall under DPDP.
Auto-renewing plans charged to Indian cards carry 18% IGST under OIDAR, and the account and billing records are personal data.
There is no turnover threshold for a foreign OIDAR supplier: the first Indian subscriber counts. User accounts bring DPDP notice and consent duties.
The shipping addresses, phone numbers and payment details of customers in India are personal data under DPDP — whatever the product.
Pre-recorded courses and streamed content are OIDAR services. Learner data — and children's data, which needs verifiable parental consent — sits under DPDP.
Pixels, device identifiers and profiles of people in India are personal data, and processing them for services offered in India brings DPDP into play.
§ 3 — Signals
None of these settles the question on its own. Together they tell us where to look.
§ 4 — India exposure check
Answer for how your product works today. Nothing leaves your browser unless you choose to book.
Indicators from your own answers — not a legal determination. Whether a law applies, and what it requires of you, is decided only after our lawyers review the facts.
§ 5 — What we do
The facts first: what you sell into India, whose data you hold and where it goes — with a written view of what applies, rated by confidence, before any work is quoted.
Simplified registration on Form GST REG-10, IGST on your invoices and checkout, monthly GSTR-5A returns, and coordination with your representative or filing partner in India.
A map of the personal data you hold, notices and consent flows that work in your product, retention rules, breach response, and a process for access, correction and erasure requests.
Privacy notices and terms written for Indian users, and data-processing terms with your vendors and processors so their obligations match yours.
If you have been selling or collecting data in India for a while, we work out the exposure and the cleanest way to regularise — and handle correspondence with authorities.
We work alongside your own counsel and accountants, from our offices in India and New York.
§ 6 — How it works
Two minutes, on this page. Nothing is stored until you choose to book.
A 60-minute call with our team, by video from anywhere; the fee is credited if we go on to work together.
What applies, what does not, and what is uncertain — each point rated High, Medium or Low confidence.
Registration, invoice and checkout changes, notices, consent flows and contracts, in the order that removes the most risk first.
A filing calendar for GSTR-5A and a DPDP review before the 13 May 2027 deadline and after major product changes.
§ 7 — Questions
Often, yes. The DPDP Act applies to processing outside India when it is connected with offering goods or services to people in India (section 3). For GST, the place of supply of an online service is where the customer is, so a foreign supplier selling to unregistered customers in India registers under a simplified scheme — no Indian entity is needed.
No. Unlike Indian businesses, a supplier of OIDAR services from outside India to customers in India who are not GST-registered has no turnover threshold: the obligation starts with the first such supply.
IGST at 18% on the supply. The supplier registers on Form GST REG-10 and files a return in Form GSTR-5A every month, by the 20th of the following month. Since 1 October 2023 this covers supplies to any unregistered recipient in India, not only individuals using the service for personal purposes.
It is common, especially since the October 2023 change widened the scope. We work out the back-period, the tax and interest involved, and the cleanest way to regularise — ideally before an authority raises it.
The DPDP Rules were notified on 13 November 2025 and phase in over eighteen months. The Data Protection Board is already constituted, the consent-manager framework follows from November 2026, and the remaining obligations — notices, consent, security safeguards, breach reporting and user rights — apply from 13 May 2027.
Only if the government designates you a Significant Data Fiduciary, based on the volume and sensitivity of the data and the risk involved; those must appoint a DPO based in India. Every other business must still publish the contact details of someone who can answer questions about how it processes personal data.
Yes. Many clients bring us in alongside their US, EU or Singapore counsel and their accountants. We have an office in New York as well as in India, and schedule calls in your time zone.
The exposure check on this page is free. A consultation is $150 (or the equivalent in INR) for a 60-minute session, paid before the call through the secure link we send when we confirm your slot. It is credited toward your legal fees if the matter proceeds.
§ 8 — Get started
A 60-minute assessment call, by video from anywhere, with a written view of what applies to you.
