The Digital Personal Data Protection Act, 2023 applies not only to the processing of DIGITAL personal data within India but also to processing OUTSIDE India, where such processing is in CONNECTION with offering goods or services to data principals in India, or any other activity the Act specifies. This illustrates:

Section 3 of the DPDP Act, 2023 sets out the Act's JURISDICTIONAL (extraterritorial) reach: it applies to the processing of DIGITAL personal data within the territory of India, to personal data collected within India and later digitised, and to processing conducted OUTSIDE India if it is in CONNECTION with offering goods or services to DATA PRINCIPALS in India or with the other connected activities the provision identifies. This extraterritorial reach brings foreign fiduciaries processing Indian principals' data within the Act's grasp. The sovereignty/location-combination test is a hallmark of modern data-protection legislation. Territoriality alone does not oust the Act.