What is specific to US companies
US privacy law is sectoral and state-based, so the contract with the Indian company sets most transfer terms. Where Indian teams process data of US residents under a contract with the US company, some DPDP Act duties are relaxed, but security obligations stay.
Our services
How SU and Company helps
We cover the Indian tax, FEMA and governance side and work alongside the group's legal counsel.
- Tax and FEMA review of contract terms
- Internal controls and documentation in the Indian company
- Coordination with counsel on data protection
Questions
Does the DPDP Act apply to data of people outside India?
Some duties are relaxed where Indian entities process non-residents' data under a contract with a foreign party, but security duties remain.
General information as at 5 November 2026, not advice for a particular case. Indian and US rules change often; confirm the current position before acting. US law points should be confirmed with a US adviser.