Dubai AI Startups Using Indian Users’ Data: DPDP Act Compliance Explained

A Dubai AI startup launches an app, and within months a large share of its users are in India. The servers are in the UAE, the company is incorporated in a free zone, and the founders assume Indian data protection law is someone else’s problem. It isn’t. India’s Digital Personal Data Protection Act, 2023 was written to reach businesses outside India that deal with people in India.

The Act’s main obligations take effect on 13 May 2027, and the penalties are the largest in Indian privacy law. This guide explains why the Act applies to a Dubai business with Indian users, the timeline, the AI-specific issues that matter most (training on user data, profiling and children), what the cross-border transfer rules say, and how to line the Indian programme up with UAE data protection law. UAE-law points should be confirmed with UAE counsel.

Why the DPDP Act reaches Dubai

The DPDP Act applies to the processing of digital personal data within India. It also applies to processing outside India if that processing is connected with offering goods or services to people in India. This is the effect of Section 3, and commentators describe it as the provision that gives the Act extraterritorial reach (Chambers; DataGuidance). The test is not where the company is incorporated or where its servers sit. A Dubai AI app that is available to Indian users, accepts Indian payments or markets to Indian audiences is offering services to people in India.

In the Act’s language, a business that decides why and how personal data is processed is a “Data Fiduciary”, and the people the data relates to are “Data Principals”. A Dubai startup collecting names, phone numbers, prompts, voice recordings or usage data from Indian users is therefore a Data Fiduciary for that data. If it uses processors, such as cloud providers, analytics tools or contract developers, they act for it, but the legal duty stays with the fiduciary.

There is an exemption that founders sometimes read too broadly. The Act excludes the processing of personal data of people outside India that is carried out under a contract with a foreign party, which protects Indian outsourcing businesses. It does not help a Dubai company that deals directly with Indian users. Anyone relying on an exemption should write down why it applies.

The timeline: what applies when

The DPDP Rules, 2025 were notified in November 2025 and phase the Act in over eighteen months. The provisions on the Data Protection Board took effect on notification. The rules on consent managers take effect after about a year, in November 2026. The substantive duties of data fiduciaries, including notice, consent, security safeguards, breach intimation, children’s data and the extra obligations of significant data fiduciaries, take effect after eighteen months, on 13 May 2027 (SCC Online; JSA; Taxmann). Some sources give 14 May, which reflects a difference in how they count from the gazette date.

The penalties give the timeline weight. The Act’s schedule provides for a penalty of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify the Board and affected people of a breach and for failing to meet the obligations on children’s data. These are maximums, set by the Data Protection Board after an inquiry, but they show how seriously the law takes security and children.

For a startup, the window to May 2027 is the time to build, not to wait. Retrofitting consent flows and data maps into a live AI product is much harder than designing them in. Treat November 2026 as the date to start your data inventory, and early 2027 as the deadline for your notices, consent screens, breach plan and processor contracts.

AI-specific issues: training, profiling and children

Training on user data is the main legal question for an AI company. The Act requires notice and consent for a specified purpose, and consent has to be free, specific, informed and unambiguous. If your terms allow you to use prompts or recordings to improve the product, say so in the notice and make it a choice the user can refuse without losing the core service. There is a narrow exception for personal data that the Data Principal herself has made publicly available, but data that someone else posted about a person, or content scraped from a platform where users post, isn’t automatically covered, so be careful before you assume that scraped Indian social media is free to use.

Profiling and automated decisions need care. The Act doesn’t create a stand-alone right against automated decision-making of the kind found in the GDPR, but it requires a Data Fiduciary to make reasonable efforts to ensure that data is complete, accurate and consistent if it is used to make a decision affecting the Data Principal. Erasure also raises hard questions for AI: a Data Principal can withdraw consent and ask for erasure when the purpose is no longer served, and how that works for a model already trained on the data is an open question. Design your pipelines so that user data can be separated from training sets where possible.

Children are the most sensitive area. The Act treats anyone under eighteen as a child. A data fiduciary must obtain verifiable consent from a parent or guardian before processing a child’s data, and it may not track or monitor children’s behaviour or direct targeted advertising at them. That affects AI companions, tutoring tools and games popular with teenagers. If your product is open to the public, decide whether you will verify age and bar minors, or build a parental consent flow, and don’t leave it to a tick box. A fiduciary that qualifies as a significant data fiduciary, based on the volume and sensitivity of the data and risks to rights, has further duties, including an independent audit, impact assessments and a Data Protection Officer who is based in India.

Cross-border transfers, Dubai hosting and UAE law

The DPDP Act takes a permissive approach to transfers outside India. Section 16 allows a Data Fiduciary to transfer personal data to any country or territory unless the Central Government has restricted it by notification. Reports as of mid-to-late 2026 say that no restricted-country list has been issued, and that the cross-border provisions themselves may not take effect until May 2027 (Taxmann; KSK). Section 16 also preserves stricter rules in other Indian laws, so sectoral rules can still apply: payment data localisation rules for payment systems, for example, matter for fintech-style AI products. Hosting in Dubai is not itself a problem under the Act as written, but you should monitor the restricted-country notifications.

UAE law runs in parallel. The federal data protection law, Federal Decree-Law No. 45 of 2021, applies on the UAE mainland, and the DIFC and ADGM have their own regimes. Sources disagree on whether the federal law’s executive regulations have been issued, and some of the deadlines quoted in vendor guides couldn’t be traced to an official text, so use official UAE sources and UAE counsel for this side. The DIFC has also adopted rules on processing by autonomous and semi-autonomous systems that matter to an AI business inside the DIFC.

A single privacy programme is usually better than two. Build your data map, notices and consent records to the stricter requirement in each area, keep one set of processor agreements that cover Indian and UAE law, and record the lawful basis for each processing purpose. When an Indian user exercises a right, you’ll need a process that works regardless of which jurisdiction’s law you apply first.

Practical steps, remedies and quick answers

Start with an inventory: which Indian users do you have, what data do you collect from them, why, where is it stored and who receives it? Rewrite your privacy notice so that it follows the Act’s requirements, and offer it in English or in any language listed in the Eighth Schedule to the Constitution, as the Act requires for consent requests. Set up a grievance contact and a process for access, correction and erasure requests. Prepare a breach plan: the Rules require intimation to affected people without delay and a detailed report to the Board within a short period, reported as seventy-two hours. Put data processing terms in every vendor contract. If a complaint arises, the Data Protection Board can inquire and impose penalties, and a fiduciary can offer a voluntary undertaking to resolve proceedings. Appeals from the Board go to the Telecom Disputes Settlement and Appellate Tribunal. The cheapest remedy is early compliance: a documented good-faith programme helps if the Board ever reviews your conduct.

Related reading: DPDP Act compliance for small businesses and startups, consent managers go live in November 2026, AI chatbots and children under the DPDP Act, the DPDP Act for US SaaS companies, the DPDP Act for UK businesses, using Indian AI teams on US client data and CERT-In’s 6-hour incident rule; also the crypto travel rule between the UAE and India; also the Indian laws that apply to a Dubai company.

Quick answers

Does the DPDP Act apply to a Dubai company with no Indian office?

Yes, if it processes personal data in connection with offering goods or services to people in India. Incorporation and server location don’t decide the question.

When do the main DPDP obligations start?

Most substantive obligations take effect on 13 May 2027 (some sources say 14 May). The consent manager rules take effect about November 2026.

Is the UAE on a restricted list for data transfers from India?

Not as far as the sources we checked show. Section 16 uses a negative list, and no list of restricted countries had been notified, but check for updates and for sector-specific rules.

What is a Data Fiduciary?

A person who decides the purpose and means of processing personal data. A Dubai startup that collects names, prompts or usage data from Indian users is a Data Fiduciary for that data, even if it uses processors.

Does the DPDP Act require data to stay in India?

Not generally. Section 16 permits transfers outside India except to countries the Central Government restricts by notification, and no restricted-country list had been notified in the sources we checked. Sector-specific localisation rules can still apply.

Final word

Halverton & Co. is an Indian law firm advising NRIs, founders, investors and businesses in Dubai and across the UAE on Indian law, including DPDP Act compliance for foreign technology companies, cross-border data transfers, privacy notices and consent design for AI products. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and work alongside UAE-licensed counsel, who advise on UAE law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create an advocate-client relationship. Halverton & Co. is an Indian law firm and does not advise on UAE law; UAE-law points should be confirmed with UAE-licensed counsel.