Summary: As businesses become increasingly global, requests from foreign regulators, courts and law-enforcement agencies for information held in India are becoming a routine part of cross-border compliance. Businesses must now play the balancing act—comply with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), on the one hand, and the laws of the requesting jurisdiction on the other. The DPDP framework does not automatically exempt foreign regulatory requests. Business must, therefore, regularly assess the basis for processing and disclosure, cross-border transfer requirements and, determine whether such request should be routed through an Indian legal mechanism.