India’s DPDP Act for UK Businesses: Do You Need to Comply?

UK businesses have spent years building UK GDPR compliance programmes, and many assume that covers them everywhere. It doesn’t. India’s new data protection law, the Digital Personal Data Protection Act, 2023, applies to many UK businesses that serve Indian customers, and its main obligations take effect on 13 May 2027.

This guide explains when the DPDP Act applies to UK businesses, how it compares with UK GDPR, what it requires, the penalties, and a practical plan for UK companies with Indian customers or operations. For the US-facing version, see our guide to India’s DPDP Act for US SaaS companies.

When the DPDP Act applies to UK businesses

The DPDP Act applies to the processing of digital personal data in India. Under Section 3(b), it also applies to processing outside India if it’s connected with offering goods or services to individuals in India. A UK e-commerce business shipping to India, a UK SaaS company with Indian users, or a UK edtech platform enrolling Indian students is likely to be covered.

The DPDP Rules, 2025, notified in November 2025, phase the law in over 18 months. Most obligations on businesses take effect on 13 May 2027, with the registration of “consent managers” beginning in November 2026; see our guide to consent managers under the DPDP Act.

UK businesses sometimes assume that because they have no Indian office, Indian law can’t reach them. The DPDP Act deliberately follows the customer, not the company, much as UK GDPR applies to non-UK businesses that target people in the UK. There’s an important exception for outsourcing. Under Section 17(1)(d), processing in India of personal data of people outside India, carried out under a contract with a person outside India, is exempt from most of the Act. So a UK business sending UK customers’ data to an Indian provider doesn’t generally bring that data within the DPDP Act, although the provider must still keep it secure; see our guide to UK GDPR transfers to India.

How the DPDP Act compares with UK GDPR

UK businesses will find much of the DPDP Act familiar: notice, a lawful basis, purpose limitation, security, breach notification, data subject rights and accountability. But there are important differences.

First, legal bases. The DPDP Act relies mainly on consent, with a short list of “legitimate uses”. There’s no general equivalent of UK GDPR’s legitimate interests basis, so processing that a UK business justifies on legitimate interests may need consent in India. Second, children. Anyone under 18 is a child under the DPDP Act, requiring verifiable parental consent, with tracking, behavioural monitoring and targeted advertising aimed at children prohibited; see our guide to children’s data and AI chatbots.

Third, breach notification. Under the DPDP Rules, a personal data breach must be reported to affected individuals and the Data Protection Board without delay, with a detailed report to the Board within 72 hours under Rule 7, and there’s no risk threshold below which notification isn’t required. Fourth, notices must be available in English or any of India’s 22 scheduled languages.

What the DPDP Act requires in practice

For UK businesses within scope, the core DPDP Act requirements are a clear, standalone, itemised privacy notice; valid consent that is free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give; reasonable security safeguards, including measures such as encryption, access controls and logging, with logs retained for at least a year; breach notification; deletion of data once its purpose is served; and processes for access, correction, erasure and grievances, with grievances resolved within 90 days.

Many UK businesses already appoint an EU or UK representative for GDPR purposes; the DPDP Act doesn’t require a local representative for most businesses, but a named contact for Indian users is required. For UK businesses, a useful approach is to treat India as another jurisdiction within an existing global privacy programme rather than building a separate one. Most DPDP Act requirements can be met by adapting UK GDPR processes, provided the differences on consent, children and breach notification are handled properly. Businesses also need to publish contact details for data questions and put contracts in place with any processors handling Indian users’ data. Businesses designated as “significant data fiduciaries” face extra duties, including a data protection officer based in India and periodic audits. Our DPDP Act compliance checklist sets out the steps.

Cross-border transfers are more relaxed than under UK GDPR: the DPDP Act allows transfers outside India except to countries the Indian government restricts. Sector-specific Indian rules, for example on payment data, still apply.

Penalties and enforcement risk

DPDP Act penalties are imposed by the Data Protection Board and can be substantial: up to ₹250 crore (roughly £22 million, depending on the exchange rate) for failing to take reasonable security safeguards to prevent a breach, up to ₹200 crore for failing to notify a breach, and up to ₹200 crore for breaching children’s data obligations. Appeals go to an Indian appellate tribunal.

For UK businesses without assets in India, direct enforcement may seem remote, but commercial pressure isn’t. Indian business customers will require DPDP compliance in contracts, investors will ask about it in due diligence, and the Indian government can block access to a platform in India after repeated penalties. For a business with a growing Indian customer base, losing market access is a serious threat.

Reputation matters as well. Indian consumers and regulators are increasingly alert to data misuse, and a public complaint about a UK brand’s data practices in India can damage trust quickly. Timing deserves attention too. In early 2026, the Indian government consulted on shortening the DPDP timeline from 18 to 12 months. The latest reports indicate that 13 May 2027 remains the deadline, but planning for an earlier date is prudent, and you should check for any change before you rely on it.

A DPDP compliance plan for UK businesses, and quick answers

Start by confirming whether you offer goods or services to individuals in India, and map the Indian personal data you hold. Then build on your UK GDPR programme: review your lawful bases for Indian processing (especially anything relying on legitimate interests), update notices and consent flows, add age assurance if minors may use your service, adapt breach procedures so the 72-hour DPDP report fits alongside your ICO notifications, and set up rights and grievance processes with a 90-day limit. Review contracts with Indian customers and with processors handling Indian data.

If complaints arise, Indian law requires individuals to use your grievance process first, so a responsive process is your first line of defence under the DPDP Act. If you are entering India more broadly, see our legal checklist for the UK-India trade deal and our guide to setting up a company in India from the UK.

Quick answers

Does India’s DPDP Act apply to UK businesses?

Yes, if they process personal data in connection with offering goods or services to individuals in India, even without an Indian presence.

Is UK GDPR compliance enough for the DPDP Act?

It’s a strong start, but India differs on legal bases, the under-18 definition of a child, breach notification without a threshold, and Indian-language notices.

When does the DPDP Act take effect?

Most obligations apply from 13 May 2027 under the phased DPDP Rules, 2025.

Related reading: selling SaaS to Indian customers from the UK and offshore data processing for UK client data; also opening a UK university campus in India and India’s Online Gaming Act for UK gaming companies; also outsourcing to India under UK GDPR: five clauses and the Ofcom ruling and Indian apps with UK users.

Final word

Halverton & Co. is an Indian law firm that advises on Indian law, including DPDP Act compliance for UK businesses, Indian data protection contracts and breach response. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and we work alongside your UK solicitors, who advise on English law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create a solicitor-client relationship. Halverton & Co. is an Indian law firm, is not authorised or regulated by the Solicitors Regulation Authority, and does not advise on English law.