The United States has no single federal privacy law, so a US company's duties depend on the kind of data and the customer. Health information falls under HIPAA, which requires a business associate agreement with any vendor, including an Indian subsidiary, that handles it. Consumer data is regulated by state laws led by California, financial data by the Gramm-Leach-Bliley Act and children's data by COPPA. Enterprise customers add their own requirements through security questionnaires, SOC 2 reports and contract terms. In India, the Digital Personal Data Protection Act, 2023 and its Rules notified on 13 November 2025 apply from 13 May 2027 for the main duties. A provision of the Act exempts certain obligations when an Indian company processes personal data of people outside India under a contract with a person outside India, which covers much vendor and captive work for US clients, but security safeguards and the rules on Indian staff and customers still apply. A US group needs one set of controls that satisfies the US customer and the Indian law.
← Back to the complete guide: How to Set Up a Subsidiary in India from the US
Key facts
| US federal | Sector laws: HIPAA, Gramm-Leach-Bliley, COPPA, FCRA; no general federal privacy statute |
|---|---|
| US states | California and a growing list of states; consumer rights, notices, vendor contracts |
| HIPAA | Business associate agreement; security rule safeguards; breach notification; offshore access disclosed to the covered entity |
| Customers | Security questionnaires, SOC 2 or ISO 27001 reports, data processing addenda |
| India | DPDP Act, 2023; Rules notified 13 November 2025; main duties from 13 May 2027; penalties up to INR 250 crore |
| Foreign data principals | Section 17(1)(d) exempts some obligations for processing of data of people outside India under a contract with a person outside India |
| Employee data | Indian staff data is covered by DPDP; US staff data processed in India is covered by US contract and policy |
| Bulk data | US rule on bulk sensitive data transfers to countries of concern; India is not listed, but onward transfers must be controlled |
What US law requires when data goes to India
A US company that sends personal data to an Indian affiliate or vendor is still responsible for it. The legal duty comes from the sector or state law, and the practical duty comes from the customer. The first step is to know which data goes where. Health records, payment and bank information, children's data, background checks and precise location data each trigger a different rule. The second step is a contract that binds the Indian recipient to the same duties, covering permitted use, security, subcontractors, breach notice, audit and return or deletion. The third is to check that the customer allows offshore processing at all, because many US health and public-sector contracts restrict or require notice of offshore access.
HIPAA and Indian teams
A covered entity or business associate that gives protected health information to a subcontractor must have a business associate agreement with it. An Indian subsidiary that handles protected health information for a US group is a subcontractor business associate, so the group needs a written agreement, the subsidiary must apply the security rule's administrative, physical and technical safeguards, and breaches must be reported to the upstream party within the agreed period. Practical points include risk analysis, access controls by role, encryption, workforce training, audit logs, a sanction policy and secure disposal. The US customer may also require that the Indian team work only from controlled premises, not from home, and may ask for evidence such as a third-party audit. See audit and controls.
State privacy laws and customer data
California's privacy law and the laws of other states give consumers rights to know, delete and correct their data and to opt out of sales and certain sharing, and require a contract with service providers that limits their use of the data. An Indian subsidiary acting as a service provider for the US company must be bound by those terms. The company should map where consumer data is stored and accessed, include the Indian entity in its records of processing, and make sure that a deletion request can reach the data held in India. Employee and job-applicant data of California residents is covered too.
India: the DPDP Act and its exemption for foreign data
The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India. It sets duties for data fiduciaries on notice, consent or listed legitimate uses, security, breach reporting, retention and the rights of individuals, and it sets up the Data Protection Board. The Rules notified on 13 November 2025 phase the duties in, with the main obligations applying from 13 May 2027 and penalties of up to INR 250 crore for the most serious failures.
A provision in Section 17(1) of the Act exempts certain obligations where personal data of people who are not in India is processed in India under a contract with a person outside India. In practice this relieves many vendor and captive centres of the notice, consent, retention and rights duties for the foreign client's data, while the general duty to take reasonable security safeguards and the rules for breaches remain relevant. The exemption does not cover the data of the centre's own Indian employees, Indian customers or any processing outside the contract. We describe the exemption from the text of the Act and the 2025 Rules, and an Indian counsel should confirm how it applies to your arrangement.
Which regime applies to which data
| Data | US rule | Indian rule | Practical control |
|---|---|---|---|
| Patient data of a US health client | HIPAA and the client contract | DPDP exemption for foreign data principals under a contract; security duties remain | Business associate agreement; security rule safeguards; restricted access |
| US consumer data | State privacy laws and the company's notices | Same exemption where processed under contract for the US company | Service provider contract; deletion workflow |
| US employee data | Employer policy; state law in places | Exempt if foreign data principal and contract | Limit access; keep in a US system where possible |
| Indian employee data | Not a US matter unless shared | DPDP applies from May 2027 | Notice, consent or legitimate use; retention rules |
| Indian customer data | Not a US matter unless shared | DPDP applies | Notice and consent; data principal rights |
Controls that satisfy customers and regulators
- Map data by type, location and access, and keep the map current.
- Use role-based access, multi-factor authentication, encryption at rest and in transit, and logging.
- Restrict removable media and home working where the contract requires it.
- Run background checks that follow Indian law and the client's requirements.
- Train staff at hiring and every year, with a short test.
- Hold a SOC 2 Type II or ISO 27001 certificate if customers ask for it, and plan the audit cycle.
- Have an incident response plan with named contacts in India and the US.
- Review vendors, including cloud and software providers, and list subprocessors.
Planning for May 2027
Even if the foreign-data exemption covers most of the client work, the Indian company will have its own employees and may have its own customers. Use the period to the main commencement date to draft an Indian privacy notice for employees, set retention periods, decide how consent or legitimate use will be recorded and name a contact for individual requests. Companies with significant volumes of Indian personal data may be designated as significant data fiduciaries and have extra duties. See the compliance calendar for the annual rhythm.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, Internal Revenue Service (US), Bureau of Industry and Security (US) and the Ministry of External Affairs (India).
Frequently asked questions
Does the US have one federal privacy law?
No. Duties come from sector laws such as HIPAA and the Gramm-Leach-Bliley Act, state laws such as California's, and customer contracts.
Do I need a business associate agreement with my Indian subsidiary?
If it handles protected health information for a US covered entity or business associate, yes. It is a subcontractor business associate.
When does the DPDP Act take full effect?
The Rules were notified on 13 November 2025 and the main duties apply from 13 May 2027, in stages.
What is the DPDP exemption for foreign data processed in India?
Section 17(1) exempts certain obligations when personal data of people outside India is processed in India under a contract with a person outside India. Security duties remain, and Indian counsel should confirm the scope.
Does DPDP apply to my Indian employees' data?
Yes. The foreign-data exemption does not cover the Indian company's own employees or customers.
Can US consumer data be stored in India?
Usually yes, with a service provider contract and the controls the US law and the customer require, unless the customer forbids offshore processing.
Do customers ask for SOC 2?
Often. SOC 2 Type II or ISO 27001 reports are common requirements in enterprise contracts.
What is the DPDP penalty?
Up to INR 250 crore for the most serious failures such as failing to take reasonable security safeguards.
Is India a country of concern for the US bulk data rule?
India is not on the list of countries of concern, but onward transfers from India to those countries would still need controls.
Related guides
Setting Up a Global Capability Centre in India as a US Company: Captive, Build-Operate-Transfer and Hybrid Models, Cost-Plus Pricing, State Policies and Key Risks
How a US company builds a captive engineering, finance or operations centre in India: the three delivery models, entity and tax choices, cost-plus transfer pricing and safe harbour questions, permanent establishment, intellectual property, state incentives and a 12-month roadmap.
Read the guide →Audit and ICOFR
Statutory audit and internal financial controls.
Read the guide →Hiring and payroll in India
Contracts, statutory benefits and the monthly payroll cycle.
Read the guide →Compliance calendar
Annual and monthly filings for an Indian subsidiary.
Read the guide →Sources
Last updated 2 November 2026. General information only, not legal or tax advice. Indian and US rules change often; confirm current requirements before acting.