The India Digital Personal Data Protection Act (DPDP) adopts a nuanced approach to territorial applicability, focusing on where the data is collected rather than solely where processing occurs.

Text of Relevant Provisions

DPDP Art.3(a):

*"Subject to the provisions of this Act, it shall—

(a) apply to the processing of digital personal data within the territory of India where the personal data is collected––

(i) in digital form; or (ii) in non-digital form and digitised subsequently;"*

Analysis of Provisions

The DPDP's application hinges on where the personal data was collected, specifically emphasizing data collected within India. While Article 3(a) mentions "processing...within the territory of India," it ties this to data collected in India, indicating the collection point as the primary determining factor.

The Act further clarifies that it applies to data collected "in digital form" or initially collected "in non-digital form and digitized subsequently." This suggests that even if data is collected offline in India, subsequent digitization within India would bring it under the DPDP's purview.

The rationale appears to be establishing a clear link between the law's application and data originating from individuals within India, regardless of where the processing takes place. This approach may be aimed at ensuring protection for data collected from individuals in India, even if processed elsewhere.

Implications

The DPDP's focus on the data collection point has significant implications for businesses:

• Companies processing data outside India: The Act could apply to companies processing data outside India if that data was originally collected from individuals within India. For instance, a foreign company analyzing data collected through its Indian subsidiary's marketing campaign in India would likely be subject to the DPDP.
• Cloud service providers: Cloud service providers with servers located outside India might still be subject to the DPDP if they process data originally collected from individuals within India.
• Data transfer compliance: Transferring data collected in India to other jurisdictions requires careful consideration under the DPDP's provisions, even if the processing itself occurs outside India.
• Focus on collection practices: Businesses must pay close attention to their data collection practices within India, as the location of collection is pivotal in determining the DPDP's applicability, potentially impacting data handling agreements and disclosures.