Foreign Universities, Indian Students & the DPDP Act

Inside this report

Table of Contents

Five parts, from the scale of Indian outbound study through the law's extraterritorial reach to a practical compliance roadmap for foreign institutions.

More than 1.3 million Indians are studying in higher education abroad, and a foreign university now collects a remarkable amount of personal data about each of them long before they ever leave the country.

The number of Indians in higher education abroad roughly doubled between 2019 and 2024. On the Ministry of External Affairs' broader count, 18.8 lakh Indians are now studying across 153 countries, the largest internationally mobile student population in the world.

Canada, the United States, the UAE, Australia and the United Kingdom together host the bulk of Indian students abroad. Each line below is a flow of data, not just of people: applicant records collected in India and carried to servers overseas.

Section 3(b) of the DPDP Act applies to the processing of digital personal data outside India "if such processing is in connection with any activity related to the offering of goods or services to Data Principals within the territory of India."

Education is a service. A foreign university that markets to, recruits, processes applications from and admits students who are in India is offering a service to Data Principals within India. The decisive fact is that the applicant is physically and legally in India at the moment the university targets them and collects their data, through education fairs, India-facing websites and advertising, in-country agent networks, and online application portals. The law, in the firm's published view, is purpose-driven rather than location-based: it does not distinguish between Indian and foreign entities where the activity has a nexus with India.

1. A

   The recruitment phase is not contestable

   Marketing, lead capture, application intake, offer-making, fee and visa processing are all directed at and performed on individuals in India. There is no serious argument that this falls outside Section 3(b).

2. B

   The university is the Data Fiduciary

   It alone determines the purpose and means of processing (Section 2(i)). In-country agents act on its behalf as Data Processors, and under Section 8(1) the university remains responsible for their processing irrespective of any agreement to the contrary.

3. C

   Relocation does not switch the duty off

   The trigger is the offering activity, fixed at the point of collection in India. The only genuinely open margin is processing that occurs purely on-campus after the student has left; the prudent reading keeps the originating relationship in scope.

Personal data is collected at every stage of recruitment, and a distinct set of duties attaches to each. The heat map shows where collection is heaviest; the obligations below apply throughout.

1. 5

   Notice in clear, multilingual form

   A standalone, itemised notice (Section 5, Rule 3) stating the data collected and the purpose, with the means to withdraw consent, exercise rights and complain to the Board, available in English or any of 22 Eighth-Schedule languages.

2. 6

   Consent that is free, specific and withdrawable

   Consent (Section 6) must be unambiguous, limited to the data needed, and as easy to withdraw as to give. There is no broad legitimate-interest basis; Section 7's consent-free grounds are a narrow, largely State-facing list.

3. 8

   Fiduciary duties: accuracy, security, erasure, breach, grievance

   Section 8 requires accurate decision-data, reasonable security safeguards, erasure on withdrawal or purpose-completion, breach notification, and a working grievance mechanism, for the university and its processors alike.

4. 11–14

   Data-principal rights, with a published response path

   Access, correction, completion, updating, erasure, grievance redressal and nomination (Sections 11–14). The Rules require the university to publish how these rights are exercised and to resolve grievances within a stated period not exceeding 90 days (Rule 14).

Applicant data collected in India and routed to a university's home-country servers, cloud or shared-service centre is a cross-border transfer, governed by Section 16 of the Act.

Penalties are set in rupees, per contravention, and may be imposed cumulatively. They are adjudicated by the Data Protection Board of India, with appeals to the Telecom Disputes Settlement and Appellate Tribunal.

An existing GDPR or FERPA programme provides real muscle, notice, access, erasure and breach-response. But five DPDP-specific gaps survive it, and each must be closed before May 2027.

A university calibrated to "sixteen is fine" will systematically under-protect its Indian applicants, lawfully everywhere else, and unlawfully in India.