India rules · all investors

Data Protection: India rules for foreign companies

CA Utsav Dogra, Chartered Accountant, ICAI M. No. 542375

India's DPDP Act treats the subsidiary as a data fiduciary for the personal data it decides how to process: employee records, customer data and vendor data. It must give notice, obtain consent or rely on a legitimate use, protect the data and report breaches.

Building one data compliance process

Where the Indian company processes data on behalf of the parent, it acts as a processor under the parent's instructions; the contract should say so and set security standards.

Data flowing from the parent's country to India must also meet that country's transfer rules, so the group usually needs a data map showing each flow and its legal basis in both countries.

Practical steps

Map each personal data flow between the countries.
Put the transfer mechanism in place for each flow.
Prepare DPDP notices, consent and security measures in India.
Run one breach process covering both countries.

Checklist

Data map of flows
Transfer mechanism per flow
DPDP notices and consents
Processor agreements
Breach response plan

Common mistakes

Assuming the parent's policy covers India
No processor agreement
Missing breach reporting
Transferring HR data without a basis

How this applies to your country

Our service: Practice areas

Questions

When must breaches be reported?

Under the DPDP Rules, personal data breaches are reported to the Data Protection Board and affected individuals within the prescribed times.

Does the DPDP Act apply to data of people outside India?

Some duties are relaxed where Indian entities process non-residents' data under a contract with a foreign party, but security duties remain.

Queries

Send the firm a query

Tell us briefly what you need. A member of the team will get back to you.

WhatsApp: Message us on WhatsApp
Telephone: +91-9999010513