Global teams are the norm now — a vendor in Singapore, a support team in the Philippines, an engineering pod in Eastern Europe, all potentially touching data belonging to Indian users. Under the DPDP Act, the question isn't just where your data is stored — it's who, anywhere in the world, can actually access it.
Where Cross-Border Access Creates Exposure:
- Global support or engineering teams are often granted broad access to production systems containing Indian users' personal data, without location-aware controls.
- Outsourced vendors and offshore contractors may have standing access long after a specific project ends.
- Access policies are frequently designed around roles and systems, with no visibility into where the person holding that access is actually located.
Why This Matters Under DPDP:
- Being able to demonstrate who accessed personal data — including their location and business justification — is central to demonstrating accountability to the Data Protection Board.
- "We don't track that" is not a defensible answer when a regulator asks about access to Indian users' data from outside India.
Bottom Line:
Access governance for DPDP compliance can't stop at defining roles and permissions — it needs to account for where access is coming from. Building location and vendor-awareness into your access policies closes a gap that most enterprises haven't fully addressed yet.
