What is specific to US companies
US privacy law is sectoral and state-based, so the contract with the Indian company sets most transfer terms. Where Indian teams process data of US residents under a contract with the US company, some DPDP Act duties are relaxed, but security obligations stay.
Our services
How S U & CO. helps
We cover the Indian tax, FEMA and governance side and work alongside the group's legal counsel.
- Tax and FEMA review of contract terms
- Internal controls and documentation in the Indian company
- Coordination with counsel on data protection
Questions
Does the DPDP Act apply to data of people outside India?
Some duties are relaxed where Indian entities process non-residents' data under a contract with a foreign party, but security duties remain.
General information as at 5 November 2026, not advice for a particular case. Indian and US rules change often; confirm the current position before acting. US law points should be confirmed with a US adviser.