India’s DPDP Act for US SaaS Companies: Do You Need to Comply?

If your US SaaS company has customers in India, India’s new data protection law probably applies to you, whether or not you have an office there. Many US founders assume that, like GDPR before it, India’s law is something they can deal with later. But “later” now has a date: May 13, 2027.

This guide explains when the DPDP Act applies to US companies, what it requires, how it compares with GDPR and US state privacy laws, the penalties, and a practical compliance plan for US SaaS businesses with Indian users. For a checklist aimed at Indian businesses, see our DPDP Act compliance checklist.

When the DPDP Act applies to US companies

India’s Digital Personal Data Protection Act, 2023 applies to the processing of digital personal data within India. It also applies outside India, under Section 3(b), to processing in connection with any activity related to offering goods or services to individuals in India. A US SaaS company that markets to and serves Indian users, takes payment in rupees, or offers an India-specific product is likely to be covered.

The DPDP Rules, 2025, notified in November 2025, phase the law in over 18 months. Most obligations on businesses take effect on May 13, 2027. The registration of “consent managers” begins in November 2026; see our guide to consent managers under the DPDP Act.

US startups are often surprised by this. In short, the DPDP Act follows the user, not the server. Where your data is stored doesn’t decide whether the DPDP Act applies; whether you’re serving people in India does. If you’re a B2B SaaS provider processing data on behalf of Indian business customers, you may be a “data processor” rather than a “data fiduciary” for that data. Your customers will then push DPDP obligations onto you through contracts. Either way, India’s data protection law will shape your contracts, product and security.

What the DPDP Act requires

The core obligations of the DPDP Act will feel familiar to anyone who has implemented GDPR, but the details differ. You need a lawful basis, which is either consent or one of a short list of “legitimate uses”. Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and as easy to withdraw as to give. Notices must be standalone, in clear language, itemize the data and purposes, and be available in English or any of India’s 22 scheduled languages.

Security and breach reporting are strict. You must take reasonable security safeguards, and the DPDP Rules require measures such as encryption or masking, access controls and logging, with logs retained for at least a year. When a breach occurs, you must notify affected individuals and the Data Protection Board without delay, and give the Board a detailed report within 72 hours under Rule 7. Unlike some laws, there’s no harm threshold. See our guides to the CERT-In 6-hour rule and to ransomware and cyber insurance.

The DPDP Act also requires reasonable contracts with any vendors that process Indian users’ data for you, so sub-processors are covered. Other duties include deleting data when the purpose is served, publishing a contact for data questions, honoring rights of access, correction, erasure and grievance redressal (with grievances resolved within 90 days), and treating everyone under 18 as a child, requiring verifiable parental consent and banning targeted advertising and tracking aimed at them. See our guide to children’s data under the DPDP Act.

DPDP vs GDPR and US state privacy laws

US companies that already comply with GDPR or California’s privacy laws have a head start, but the DPDP Act isn’t a copy. The key differences are that the DPDP Act has fewer legal bases than GDPR (there’s no general “legitimate interests” basis), defines a child as anyone under 18, requires breach notification without any risk threshold, and requires notices to be available in Indian languages.

The DPDP Act is also simpler in some respects. It doesn’t distinguish categories of sensitive data in the way GDPR does, and its cross-border rules take a “negative list” approach: transfers are allowed except to countries the government restricts. The government can also designate “significant data fiduciaries” with extra duties, such as appointing a data protection officer based in India and conducting audits. For companies selling into Europe too, see our guide to the EU AI Act for Indian SaaS companies.

For most US SaaS companies, the practical approach is to extend existing privacy programs: map Indian users’ data, adjust consent and notice flows for India, add India-specific breach procedures and rights handling, and review contracts with Indian customers and vendors. Consent screens should avoid manipulative design; see our guide to dark patterns in Indian apps.

Penalties and enforcement risk for US companies

The DPDP Act’s penalties are significant. The maximum penalties include up to ₹250 crore (approximately $30 million, depending on the exchange rate) for failing to take reasonable security safeguards to prevent a breach, up to ₹200 crore for failing to notify a breach, and up to ₹200 crore for breaches of children’s data obligations. Penalties are imposed by the Data Protection Board after an inquiry, and appeals go to an Indian appellate tribunal.

US companies sometimes ask whether the DPDP Act matters if they’re small. The Act has no size threshold. For US companies with no assets in India, enforcement may look remote, but it isn’t the only risk. Indian business customers will require DPDP compliance in contracts, investors will ask about it in diligence, and the Act allows the Indian government to block access to a platform in India after repeated penalties. For a SaaS company with a growing Indian user base, losing access to the market is a serious threat.

There’s also a timing point. India’s government consulted in early 2026 on shortening the compliance timeline from 18 months to 12. The latest reports indicate May 13, 2027 remains the deadline, but planning for an earlier date is prudent, and you should check for any MeitY notification before you rely on it.

A DPDP compliance plan for US SaaS companies

Start with scoping: confirm whether you offer services to individuals in India and whether you’re a data fiduciary or a processor for Indian data. Map the Indian personal data you hold, then update notices and consent flows, add age checks if minors may use your product, and set up processes for rights requests and grievances.

Build India into your breach response plan, so that the 72-hour report to the Board fits alongside your US state-law and GDPR notifications. Review contracts with Indian customers and with vendors that process Indian data. If your product uses employee or candidate data, see our guide to AI in hiring and employee monitoring. If a complaint arises, Indian law requires the individual to use your grievance process first, so a responsive process is your first line of defense. If your team is in India, the structure matters too; see setting up an Indian subsidiary.

Quick answers

Does India’s DPDP Act apply to US companies?

Yes, if they process personal data in connection with offering goods or services to individuals in India, even without an Indian office.

When does DPDP compliance start?

Most obligations apply from May 13, 2027, under the phased DPDP Rules, 2025.

Is GDPR compliance enough for the DPDP Act?

It helps, but India differs on legal bases, the under-18 definition of a child, breach reporting without a threshold, and Indian-language notices.

Related reading: India’s DPDP Act for UK businesses; also selling SaaS to Indian customers from the UK; also licensing US software in India: withholding tax and royalties; also structuring AI training data licences after Ross; also AI training data provenance audits after Bartz and Grok, deepfakes and platform liability for US companies in India.

Final word

Halverton & Co. is an Indian law firm that advises on Indian law, including DPDP compliance for US SaaS companies, Indian data protection contracts and breach response. We practice in Jharkhand, Maharashtra and before the Supreme Court of India, and we work alongside US counsel, who advise on US law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create an attorney-client relationship. Halverton & Co. is an Indian law firm and does not advise on US law.