Cross-Border Rights Requests: When an Individual Outside India Asks for Access

Section 3 gives the Act extraterritorial reach: if a Data Fiduciary offers goods or services to individuals located in India, the Act's obligations - including rights handling - apply regardless of where the individual happens to be physically located when they submit the request. That means a request from someone currently overseas can still fall squarely within the DPDP Act's scope, if the underlying relationship is with an India-based individual.

The mistake to avoid is triaging a request purely on the sender's current location or the country code on their contact details. The relevant question is whether the individual is, or was, an India-based person to whom you offered goods or services, not where their email happens to be routed from today.

Once you have established that the individual is within the Act's scope, the request should be handled through the same process as any domestic rights request - the same Section 11 access obligations, the same Section 12 correction and erasure standards, the same grievance mechanism under Section 13. Nothing in the Act creates a lighter-touch version of these rights for people who happen to be abroad.

Where it gets more complicated is when the same individual's data is also subject to another jurisdiction's privacy law because of where they currently live or hold citizenship. In that situation, both frameworks may apply, and the response should be built to satisfy the DPDP Act's requirements at minimum, with legal review on whether additional obligations from the other regime also need to be folded in.

Identity verification gets harder across borders, since the documents or verification channels you normally rely on for India-based individuals may not be available to someone submitting a request from another country. Build a fallback verification path - alternative documents, a video call, or a secondary contact method - so cross-border requests are not stuck for that reason alone.

Time zones and language also matter more here than in a domestic request. Make sure the prescribed response timeframe under the Rules accounts for the practical reality of coordinating with someone in a different time zone, without treating that as an excuse to simply run past the deadline.

The Applicability Checker on this site is a quick way to confirm whether a specific relationship falls within the DPDP Act's scope before your team spends time on a full response, which is especially useful for these less obvious cross-border cases.