Businesses & Professionals
Cross-Border Data & Global Applicability
Where India's DPDP Act reaches beyond India's borders — whether it applies to foreign companies serving Indian users, what's allowed when you send Indian customer data overseas, and how DPDP sits against regimes like GDPR. For any business operating across borders in either direction.
Foreign SaaS tools for Indian customer data: what DPDP saysSalesforce, Dropbox, an overseas AI vendor for Indian customer data? Generally allowed under DPDP's negative list — but you stay accountable. The vendor-DPA checklist.Does the DPDP Act apply to foreign companies serving Indian users?Section 3(b) reaches foreign companies with no India presence — if they offer goods or services to people in India. When DPDP catches an overseas business, and when it doesn't.Sending Indian customer data overseas: what's allowed, restricted, and still being decidedDPDP's negative-list model allows overseas transfer unless a country is restricted — none is yet. What Rule 15 and sectoral localisation add, and what's still unsettled.India vs GDPR: what's different, what's similar, and what it means in both marketsDPDP and GDPR overlap but diverge — sensitive data, legal bases, transfers, children's age, rights, and penalties. What differs, what's the same, and what it means in both.Your Indian startup has global users: staying DPDP-compliant in both directionsDPDP cuts both ways for an Indian startup with global users — extra-territorial reach inward, and cross-border transfer rules outward. What actually applies, and what doesn't yet.Can Indian businesses store data on AWS or Google Cloud foreign servers under DPDP?No general localisation mandate under DPDP — foreign cloud regions are allowed by default. The sectoral and SDF catches that can force India-only storage, and how to decide.