India: compliance overview

1 regulations, 7 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind us Contact an advisor

Applicable regulations (1)

Phased applicationData & privacyRelevance High

India Digital Personal Data Protection Act, 2023

Section 3(b) states that the Act applies to processing of digital personal data outside India where that processing is in connection with any activity related to offering goods or services to Data Principals within India. For a Chinese AI company this means that offering products or services to Indian users through app stores, websites, APIs or local distribution, and thereby processing their digital personal data, brings it in scope without any Indian establishment. The converse carve-out is s.17(1)(d): where a person based in India processes the personal data of Data Principals not within India under a contract with a person outside India, Chapter II (other than ss.8(1) and 8(5)), Chapter III and s.16 do not apply — the legal basis for India’s offshore data-processing industry, but not available for processing Indian users’ data.

7 obligations · reviewed 2026-09-12

Data transfer routes

India DPDP Act restricted-country mechanism (s 16)
No volume threshold and no general pre-transfer approval or contract requirement - the trigger is simply whether the Central Government has notified a restriction for a particular country or territory. An important limit on this research pass: it could not verify from an Indian official source (MeitY or the Gazette of India) (1) whether section 16 has been brought into force, (2) whether any restriction notification has been issued, or (3) the publication and commencement status of the Digital Personal Data Protection Rules and their provisions on processing outside India. This entry therefore verifies only the text of section 16 of the 2023 Act (from the official Gazette PDF); commencement and the subordinate rules are unverified and confidence is medium. Any operational call must be checked against MeitY and the Gazette of India for the current notifications and rules, and against the existing localisation and transfer restrictions of the relevant sector regulator (the Reserve Bank of India, IRDAI, the telecom authorities), which prevail under section 16(2).
Lead time: Estimate: 1-2 weeks in the normal case to compare the destination list and adjust contracts; where a destination is notified as restricted, migration typically takes 2-6 months depending on data volume and system coupling. Whether notifications carry a transition period was not verified in this pass. · Cost band Low

Sources (1)

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), India — official textMinistry of Electronics and Information Technology (MeitY), India · published 2023-08-11 · retrieved 2026-09-12

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.