When the DPDP Act Can Apply Outside India

The Digital Personal Data Protection Act, 2023 (DPDP Act) can apply to processing outside India when that processing is connected with an activity related to offering goods or services to people in India. The test in section 3(b) is about the connection between the processing and the India-facing offer—not simply where a sender or server is located. An email to someone in India is not, by itself, enough to establish that the Act applies.

Reviewed October 26, 2026. The Act’s text provides the starting point, but whether a particular campaign is within scope depends on the facts and applicable commencement provisions. This is general information, not legal advice.

What section 3(b) says

Section 3 sets out the Act’s application. In relevant part, section 3(b) covers processing of digital personal data outside India if it is in connection with an activity related to offering goods or services to Data Principals within India. The Act’s definition of a Data Principal refers to the individual to whom the personal data relates. 1

This gives an overseas company a reason to assess its India-facing business activity, even if it has no office in India. But the wording does not say that every overseas business message—or every record about a person located in India—is automatically covered. The key statutory connection is between processing the digital personal data and an activity related to offering goods or services in India.

“Processing” is broader than sending the message itself. Depending on the facts, an organization may need to examine how it collects, stores, organizes, uses, or otherwise handles digital personal data in connection with an offer. Do not reduce the scope review to the email platform or the physical location of the sender.

A practical scope decision procedure

Use these questions to decide whether a campaign needs a closer DPDP review. They are a screening tool, not a legal conclusion.

1. Is the information digital personal data? Identify the data in the contact record and campaign workflow. Consider whether it relates to an identifiable individual, rather than assuming that a business email address is outside the Act because it is used at work.
2. Is any processing happening outside India? Map the organizations and systems that handle the data, including the sender, service providers, and storage or campaign tools. Location alone does not decide the question, but it helps identify the cross-border processing to assess.
3. Is there an offer of goods or services connected to India? Look for concrete evidence: the intended audience, campaign content, recipient eligibility, sales or service availability, and the planned follow-up. A person’s location in India is relevant to the statutory wording, but it does not alone establish that the campaign is an India-facing offer.
4. Is the processing connected to that offer? Trace why the contact data is used. If it is used to identify, reach, qualify, or follow up with prospective customers for an India-related offer, document that connection for review. If the message is unrelated to an offer, do not assume section 3(b) applies; assess the actual facts.
5. Check timing and other obligations separately. Confirm which provisions are in force for the relevant date and whether other privacy, marketing, or sector rules may apply. The territorial-scope analysis is not a substitute for those checks.

If the facts point toward an India-facing offer and related personal-data processing, pause to document the rationale and obtain qualified advice before scaling the campaign. If the connection is uncertain, record the uncertainty and the facts that would change the conclusion rather than labeling all India outreach covered or exempt.

Scope review checklist

Keep the evidence specific to the campaign. A generic note such as “we emailed India” does not explain the offer, the data use, or their relationship.

What this does not settle

Section 3(b) answers a territorial-scope question; it does not by itself resolve every question about lawful processing, notices, individual rights, retention, safeguards, or outreach rules. Those issues may require separate analysis. Keep this assessment alongside broader compliance operations, and use the new-country review process to check other country-specific requirements.

Cross-border data movement is also distinct from whether section 3(b) applies. Review adequacy versus safeguards in cross-border routing as a separate question; do not treat a routing decision as an answer to territorial scope. For agency teams, a documented cross-border review workflow can help preserve the facts and decisions behind each campaign.

Common mistakes to avoid

• Treating recipient location as the whole test. The text also calls for a connection to an activity related to offering goods or services in India.
• Treating sender location as an exemption. Section 3(b) expressly addresses processing outside India when its conditions are met.
• Calling every cold email covered. The Act’s wording is not a blanket rule for all outbound messages; assess the offer and processing relationship.
• Confusing scope with compliance. Being within scope does not answer every requirement; being uncertain about scope is not a reason to skip review.
• Ignoring timing. Check applicable commencement information rather than assuming the same provisions apply on every campaign date.

Sources