--- title: "India Data Privacy Law for US Companies" date: 2026-09-29 author: "Sagar Agrawal" url: https://ksandk.com/usa-desk/india-data-privacy-law-for-us-companies/ --- USA Desk guide · Data Privacy # India's DPDP Act: A Compliance Guide for US Companies India's Digital Personal Data Protection Act applies to many US businesses that never set foot in India. This guide explains who is covered, the deadlines, what compliance involves, and how it differs from CCPA and other US privacy laws. By [Dhruv Kaushal](https://ksandk.com/people/dhruv-kaushal/), Partner · Updated 30 September 2026 **Short answer:** if your US company offers goods or services to people in India, or employs staff there, India's Digital Personal Data Protection Act, 2023 (DPDP Act) likely applies. The DPDP Rules were notified on 13 November 2025, and the core obligations take effect around 13 May 2027. India uses a consent-first model with no "legitimate interests" basis, requires breach reports to a regulator within 72 hours, and allows penalties of up to INR 250 crore (about USD 26 million). ## 1. Does India's DPDP Act apply to your US company? The Act covers **digital personal data**: personal data collected in digital form, or collected on paper and later digitized. It applies in two situations: - **Processing in India:** any processing of digital personal data within India, such as your Indian subsidiary's HR and customer records. - **Processing outside India:** processing anywhere in the world if it is connected with offering goods or services to people in India. A US SaaS company with Indian customers, or a US retailer shipping to India, falls within this. Unlike the GDPR, the DPDP Act has no separate trigger for monitoring behavior, and it has no revenue or volume threshold. There is no small-business exemption like the CCPA's. Data that a person has made publicly available, and data processed purely for personal or domestic purposes, are excluded. Under the Act your company is a **Data Fiduciary** (the GDPR "controller"), vendors processing on your behalf are **Data Processors**, and the individuals are **Data Principals**. ## 2. Key deadlines The DPDP Rules, 2025 were notified on 13 November 2025 with an 18-month phase-in: | When | What applies | | --- | --- | | 13 November 2025 | Provisions establishing the Data Protection Board of India and its procedures | | About 13 November 2026 | Registration and obligations of consent managers | | About 13 May 2027 | Everything else: notice and consent, security safeguards, breach notification, data retention and erasure, children's data, rights of individuals, cross-border transfers and penalties | **Possible acceleration:** in January 2026 the Ministry of Electronics and IT proposed shortening the timeline for Significant Data Fiduciaries to 12 months. As of September 2026 no amendment has been notified, but large platforms should plan as if it could be. ## 3. Core obligations for US businesses ### Notice and consent Processing must rest on consent, or on one of a short, closed list of "legitimate uses" in section 7 (such as data a person voluntarily provides for a specified purpose, legal obligations, medical emergencies and certain employment purposes). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Each request must come with a standalone notice in plain language that itemizes the data collected, explains the purposes, and shows how to withdraw consent as easily as it was given. ### Security and processors You must take reasonable security safeguards, including encryption or masking, access controls and at least one year of processing logs. You remain responsible for your processors, so vendor contracts need DPDP-specific terms. ### Breach notification For every personal data breach, whatever its size, you must inform affected individuals without delay and notify the Data Protection Board, with a detailed report within 72 hours of becoming aware of it. There is no risk-of-harm threshold like those in many US state laws. ### Children's data A "child" is anyone under 18, not 13 as under COPPA. Processing children's data requires verifiable parental consent, and tracking, behavioral monitoring and targeted advertising directed at children are prohibited, subject to narrow exemptions. ### Retention and rights Data must be erased once the purpose is served or consent is withdrawn. Large e-commerce, gaming and social media platforms must erase data three years after a user's last interaction, after giving 48 hours' notice. Individuals can access, correct and erase their data and nominate someone to act for them, and grievances must be answered within 90 days. ### Significant Data Fiduciaries The government can designate companies as Significant Data Fiduciaries based on data volume and risk. They must appoint a Data Protection Officer based in India, run annual data protection impact assessments and audits, and may be told to keep specified data in India. No designations have been announced yet. ## 4. Can you send Indian personal data to the US? Yes, by default. Section 16 takes a negative-list approach: transfers are allowed to any country unless the government restricts that country by notification. No country has been restricted so far. There are no standard contractual clauses or adequacy decisions to manage, unlike under the GDPR. Two caveats apply. Sector rules that are stricter still prevail, most notably the RBI's 2018 direction that payment system data be stored only in India. And the Rules allow the government to impose requirements on making personal data available to foreign governments, which matters for US companies that receive government data requests. ## 5. DPDP Act vs CCPA: key differences | Issue | India (DPDP Act) | California (CCPA/CPRA) | | --- | --- | --- | | Basic model | Opt-in consent, plus a closed list of legitimate uses | Notice and opt-out of sale or sharing | | Who is covered | Every business processing digital personal data; no thresholds | Businesses above revenue or data-volume thresholds | | Sensitive data | No separate category; all personal data treated alike | Separate category with a right to limit use | | Children | Under 18; verifiable parental consent; no targeted ads | Opt-in for sale of data of under-16s; COPPA for under-13s | | Breach notice | Every breach, to the regulator (72-hour report) and affected individuals | Notice to affected residents; to the Attorney General above 500 residents | | Enforcement | Data Protection Board penalties up to INR 250 crore; no private right to damages | CPPA and Attorney General fines; limited private right of action for breaches | The biggest practical change for US teams is consent. A privacy program built on CCPA opt-outs will not meet the DPDP Act without new consent flows and notices for Indian users. ## 6. Penalties and enforcement Penalties are imposed by the Data Protection Board of India, which was established in November 2025. Appointments to the Board are in progress. The maximum penalties per instance are: - INR 250 crore (about USD 26 million) for failing to take reasonable security safeguards - INR 200 crore (about USD 21 million) for failing to notify a breach, or for breaching children's data obligations - INR 150 crore for breaching Significant Data Fiduciary obligations - INR 50 crore (about USD 5 million) for other breaches Appeals from the Board go to the Telecom Disputes Settlement and Appellate Tribunal. Individuals cannot sue for statutory damages under the Act, but they can complain to the Board. ## 7. A compliance roadmap for US companies 1. **Map your Indian data:** which products, teams and vendors touch personal data of people in India. 2. **Decide your legal bases:** where you need consent and where a legitimate use applies, especially for employee data. 3. **Rebuild notices and consent flows** for Indian users, including withdrawal and consent manager integration if you use one. 4. **Update vendor contracts** and your incident response plan for the 72-hour Board report. 5. **Review children's data** if any users could be under 18. 6. **Set retention schedules** and a process to handle access, correction and erasure requests within 90 days. 7. **Check sector rules** such as payment data localization. With the main obligations starting in May 2027, most US companies should begin the gap assessment now. Our DPDP articles cover specific issues in more depth, such as [impact assessments](https://ksandk.com/data-protection-and-data-privacy/dpias-under-dpdp-act-managing-high-risk-data-processing/) and [employee background checks](https://ksandk.com/data-protection-and-data-privacy/employee-background-verification-dpdp-act/). This guide is general information current as of 30 September 2026. It is not legal advice, and reading it does not create an attorney-client relationship. USD figures use about INR 96 to USD 1. Your team ## Partners who lead DPDP programs for US companies ![Dhruv Kaushal](https://ksandk.com/wp-content/uploads/e18ba7fb-7799-4a25-b56b-436d5a95a1bf.png) #### Dhruv Kaushal Partner, Data Protection & Technology Advises on DPDP Act compliance, technology contracts and data-driven transactions, including a US acquisition of an Indian business. [View profile](https://ksandk.com/people/dhruv-kaushal/) ![Jidesh Kumar](https://ksandk.com/wp-content/uploads/jidesh-Ksandk.webp) #### Jidesh Kumar Managing Partner Leads the firm's technology and information technology law practice and oversees the USA Desk. [View profile](https://ksandk.com/people/jidesh-kumar/) Related reading ## More from King Stubb & Kasiva ### [Data privacy in India: key FAQs for companies](https://ksandk.com/data-protection-and-data-privacy/data-privacy-in-india-2025-key-faqs-for-companies/) [Read](https://ksandk.com/data-protection-and-data-privacy/data-privacy-in-india-2025-key-faqs-for-companies/) ### [Does the DPDP Act require separate privacy notices?](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-separate-privacy-notices/) [Read](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-separate-privacy-notices/) ### [Data protection impact assessments under the DPDP Act](https://ksandk.com/data-protection-and-data-privacy/dpias-under-dpdp-act-managing-high-risk-data-processing/) [Read](https://ksandk.com/data-protection-and-data-privacy/dpias-under-dpdp-act-managing-high-risk-data-processing/) FAQ ## DPDP questions from US clients Does India's data privacy law apply to US companies? Yes, if the company processes digital personal data in India, or processes data anywhere in connection with offering goods or services to people in India. There is no revenue threshold or small-business exemption. When does the DPDP Act take effect? The DPDP Rules were notified on 13 November 2025. Board provisions applied immediately, consent manager rules apply from about 13 November 2026, and the core obligations on consent, security, breach reporting, retention, children's data and transfers apply from about 13 May 2027. Is India's DPDP Act like the GDPR? It shares some ideas, such as purpose limitation and individual rights, but it is simpler and stricter on consent. There is no legitimate interests basis, no separate sensitive-data category, and cross-border transfers are allowed by default unless the government restricts a country. Can we transfer Indian users' data to servers in the US? Yes. Transfers are permitted unless the government restricts a destination country, and none has been restricted so far. Stricter sector rules, such as the RBI's payment data localization direction, still apply. How quickly must a data breach be reported in India? Affected individuals and the Data Protection Board must be told without delay, and a detailed report must reach the Board within 72 hours of becoming aware of the breach. This applies to every breach, regardless of its severity. Do we need a Data Protection Officer in India? Only if the government designates your company a Significant Data Fiduciary, in which case the DPO must be based in India. Every other business must still publish contact details for someone who can answer questions about its data processing. What are the fines under India's DPDP Act? Up to INR 250 crore (about USD 26 million) per instance for security failures, up to INR 200 crore for breach notification or children's data failures, up to INR 150 crore for Significant Data Fiduciary breaches, and up to INR 50 crore for other breaches. ## Get ahead of the May 2027 deadline We run DPDP gap assessments for US companies and turn them into a practical plan your product and legal teams can follow. [Contact the USA Desk](https://ksandk.com/usa-desk/#contact)[Back to the USA Desk](https://ksandk.com/usa-desk/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)