Short answer: if your US company offers goods or services to people in India, or employs staff there, India's Digital Personal Data Protection Act, 2023 (DPDP Act) likely applies. The DPDP Rules were notified on 13 November 2025, and the core obligations take effect around 13 May 2027. India uses a consent-first model with no "legitimate interests" basis, requires breach reports to a regulator within 72 hours, and allows penalties of up to INR 250 crore (about USD 26 million).
1. Does India's DPDP Act apply to your US company?
The Act covers digital personal data: personal data collected in digital form, or collected on paper and later digitized. It applies in two situations:
- Processing in India: any processing of digital personal data within India, such as your Indian subsidiary's HR and customer records.
- Processing outside India: processing anywhere in the world if it is connected with offering goods or services to people in India. A US SaaS company with Indian customers, or a US retailer shipping to India, falls within this.
Unlike the GDPR, the DPDP Act has no separate trigger for monitoring behavior, and it has no revenue or volume threshold. There is no small-business exemption like the CCPA's. Data that a person has made publicly available, and data processed purely for personal or domestic purposes, are excluded.
Under the Act your company is a Data Fiduciary (the GDPR "controller"), vendors processing on your behalf are Data Processors, and the individuals are Data Principals.
2. Key deadlines
The DPDP Rules, 2025 were notified on 13 November 2025 with an 18-month phase-in:
| When | What applies |
|---|---|
| 13 November 2025 | Provisions establishing the Data Protection Board of India and its procedures |
| About 13 November 2026 | Registration and obligations of consent managers |
| About 13 May 2027 | Everything else: notice and consent, security safeguards, breach notification, data retention and erasure, children's data, rights of individuals, cross-border transfers and penalties |
Possible acceleration: in January 2026 the Ministry of Electronics and IT proposed shortening the timeline for Significant Data Fiduciaries to 12 months. As of September 2026 no amendment has been notified, but large platforms should plan as if it could be.
3. Core obligations for US businesses
Notice and consent
Processing must rest on consent, or on one of a short, closed list of "legitimate uses" in section 7 (such as data a person voluntarily provides for a specified purpose, legal obligations, medical emergencies and certain employment purposes). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Each request must come with a standalone notice in plain language that itemizes the data collected, explains the purposes, and shows how to withdraw consent as easily as it was given.
Security and processors
You must take reasonable security safeguards, including encryption or masking, access controls and at least one year of processing logs. You remain responsible for your processors, so vendor contracts need DPDP-specific terms.
Breach notification
For every personal data breach, whatever its size, you must inform affected individuals without delay and notify the Data Protection Board, with a detailed report within 72 hours of becoming aware of it. There is no risk-of-harm threshold like those in many US state laws.
Children's data
A "child" is anyone under 18, not 13 as under COPPA. Processing children's data requires verifiable parental consent, and tracking, behavioral monitoring and targeted advertising directed at children are prohibited, subject to narrow exemptions.
Retention and rights
Data must be erased once the purpose is served or consent is withdrawn. Large e-commerce, gaming and social media platforms must erase data three years after a user's last interaction, after giving 48 hours' notice. Individuals can access, correct and erase their data and nominate someone to act for them, and grievances must be answered within 90 days.
Significant Data Fiduciaries
The government can designate companies as Significant Data Fiduciaries based on data volume and risk. They must appoint a Data Protection Officer based in India, run annual data protection impact assessments and audits, and may be told to keep specified data in India. No designations have been announced yet.
4. Can you send Indian personal data to the US?
Yes, by default. Section 16 takes a negative-list approach: transfers are allowed to any country unless the government restricts that country by notification. No country has been restricted so far. There are no standard contractual clauses or adequacy decisions to manage, unlike under the GDPR.
Two caveats apply. Sector rules that are stricter still prevail, most notably the RBI's 2018 direction that payment system data be stored only in India. And the Rules allow the government to impose requirements on making personal data available to foreign governments, which matters for US companies that receive government data requests.
5. DPDP Act vs CCPA: key differences
| Issue | India (DPDP Act) | California (CCPA/CPRA) |
|---|---|---|
| Basic model | Opt-in consent, plus a closed list of legitimate uses | Notice and opt-out of sale or sharing |
| Who is covered | Every business processing digital personal data; no thresholds | Businesses above revenue or data-volume thresholds |
| Sensitive data | No separate category; all personal data treated alike | Separate category with a right to limit use |
| Children | Under 18; verifiable parental consent; no targeted ads | Opt-in for sale of data of under-16s; COPPA for under-13s |
| Breach notice | Every breach, to the regulator (72-hour report) and affected individuals | Notice to affected residents; to the Attorney General above 500 residents |
| Enforcement | Data Protection Board penalties up to INR 250 crore; no private right to damages | CPPA and Attorney General fines; limited private right of action for breaches |
The biggest practical change for US teams is consent. A privacy program built on CCPA opt-outs will not meet the DPDP Act without new consent flows and notices for Indian users.
6. Penalties and enforcement
Penalties are imposed by the Data Protection Board of India, which was established in November 2025. Appointments to the Board are in progress. The maximum penalties per instance are:
- INR 250 crore (about USD 26 million) for failing to take reasonable security safeguards
- INR 200 crore (about USD 21 million) for failing to notify a breach, or for breaching children's data obligations
- INR 150 crore for breaching Significant Data Fiduciary obligations
- INR 50 crore (about USD 5 million) for other breaches
Appeals from the Board go to the Telecom Disputes Settlement and Appellate Tribunal. Individuals cannot sue for statutory damages under the Act, but they can complain to the Board.
7. A compliance roadmap for US companies
- Map your Indian data: which products, teams and vendors touch personal data of people in India.
- Decide your legal bases: where you need consent and where a legitimate use applies, especially for employee data.
- Rebuild notices and consent flows for Indian users, including withdrawal and consent manager integration if you use one.
- Update vendor contracts and your incident response plan for the 72-hour Board report.
- Review children's data if any users could be under 18.
- Set retention schedules and a process to handle access, correction and erasure requests within 90 days.
- Check sector rules such as payment data localization.
With the main obligations starting in May 2027, most US companies should begin the gap assessment now. Our DPDP articles cover specific issues in more depth, such as impact assessments and employee background checks.
This guide is general information current as of 30 September 2026. It is not legal advice, and reading it does not create an attorney-client relationship. USD figures use about INR 96 to USD 1.
