DPDPA readiness for US companies processing Indian personal data.
The DPDPA applies to a US company even without an establishment in India where it processes the personal data of individuals in India in connection with offering them goods or services. A US SaaS provider, e-commerce platform, or analytics business with Indian users is therefore a Data Fiduciary under Indian law, must have a lawful basis for processing, must honour Data Principal rights, and must appoint a point of contact or, if designated a Significant Data Fiduciary, a Data Protection Officer resident in India.
US companies frequently assume their existing privacy programme built for state privacy laws covers India, but the consent-centric DPDPA, the notice requirements, the breach-notification duty to the Data Protection Board, and the cross-border and children-data rules differ materially. We assess the company India nexus, build a DPDPA compliance programme that extends the existing US framework rather than duplicating it, and set up the consent, notice, rights-response, and breach-response machinery the Act requires.
Confirming whether and how the DPDPA applies to the US company based on its processing of Indian personal data and its offering of goods or services to India.
Establishing the consent and legitimate-use basis for each processing activity and drafting the DPDPA-compliant notice.
Building the process to honour access, correction, erasure, grievance, and nomination rights within the timelines.
Setting up the breach-detection and notification process to the Data Protection Board and affected Data Principals as the Act and Rules require.
Assessing Significant Data Fiduciary designation and the resulting obligations, including a Data Protection Officer, DPIA, and audit.
Extending the existing US privacy programme to cover the DPDPA-specific obligations efficiently rather than building a parallel system.
Yes, if it processes the personal data of individuals in India in connection with offering them goods or services. The Act applies extra-territorially to that processing, so a US company with Indian users is a Data Fiduciary regardless of having no Indian establishment.
Not fully. The DPDPA is consent-centric and has its own notice, breach-notification, cross-border, and children-data rules that differ from US state laws. The existing programme is a foundation, but it has to be extended to meet the India-specific obligations.
It needs a point of contact for Data Principal grievances, and if it is designated a Significant Data Fiduciary it must appoint a Data Protection Officer based in India, along with the additional SDF obligations.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Share the key facts for a confidential preliminary assessment of your India matter.