Extraterritorial Application

Section 3(b) of the DPDPA establishes extraterritorial jurisdiction, mandating that any entity, regardless of its physical location, must comply with the DPDP Act if it processes personal data in connection with offering goods or services to individuals within the territory of India. This ensures that foreign entities processing data of Indian individuals cannot avoid compliance by locating their operations outside India.

The key trigger is offering goods or services to individuals in India. Indicators that an entity is targeting Indian consumers may include: websites or apps available in Indian languages, pricing in Indian rupees, marketing directed at Indian audiences, delivery or service availability in India, and use of Indian payment methods. Mere accessibility of a website from India, without active targeting, may not be sufficient.

The DPDPA's extraterritorial provision is similar to GDPR Article 3(2), which applies to processing related to offering goods or services to EU data subjects. However, the GDPR also covers 'monitoring of behaviour' within the EU, which the DPDPA does not explicitly include. This means that a foreign entity tracking behaviour of Indian users without offering goods or services may fall outside the DPDPA's scope - a gap that the GDPR addresses.

Enforcing the DPDPA against foreign entities presents practical challenges: jurisdictional reach of the Board, service of notices, execution of orders, and collection of penalties. International cooperation mechanisms and mutual legal assistance treaties may be needed. Foreign entities with a physical presence in India through subsidiaries, offices, or representatives are more easily subject to enforcement.