Skip to content

Extraterritorial Application

What is Extraterritorial Application?

The application of privacy laws beyond a country's borders to foreign organizations that process the personal data of that country's residents.

Privacy and Data Protection

Each of these is named in at least one of the same controls as extraterritorial application. The number is how many controls name both.

What the standards actually require on extraterritorial application

Requirements naming extraterritorial application across 6 standards, quoted from the control text.

Digital Personal Data Protection Act 2023 (DPDP Act) Act No. 22 of 2023 was passed by the Indian Parliament + received the assent of President Droupadi Murmu on 11 August 2023 + published in the Gazette of India Extraordinary Part II Section 1 on 12 August 202...

DPDP-Scope-1to3-Definitions-IndiaParliament-11August2023-Rules2025-MeitY-Puttaswamy-IT-Act-43A-Repeal · DPDP Act Scope + Sections 1-3 + Definitions + Indian Parliament 11 August 2023 + DPDP Rules 2025 + MeitY Governance + Justice K.S. Puttaswamy + Repeal of IT Act 43A + Extraterritorial Application →

Indonesia Personal Data Protection Law (Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, UU PDP) signed into law by President Joko Widodo on 17 October 2022 + published in the State Gazette of Indonesia + becoming Indonesia first comprehensive...

IDPdp-Scope-UU27-2022-Joko-Widodo-17Oct2022-Effective-17Oct2024-MoCom-DPA-Extraterritorial · Indonesia PDP Law Scope + UU No. 27 of 2022 (UU PDP) + President Joko Widodo 17 October 2022 + 2-Year Transition + Effective 17 October 2024 + MoCom DPA + Extraterritorial Application + 76 Articles + 16 Chapters →

The Jamaica Data Protection Act 2020 (Act No. 7 of 2020) is Jamaica's first comprehensive data protection legislation passed by the Jamaican Parliament 16 June 2020 + assented to by the Governor-General 30 June 2020 + published in the Gazette 1 July 2020.

JM-DPA2020-Scope-Application-Sec1-3-31Dec2021-PartialEffective-1Dec2023-MandatoryCompliance-Territorial-Extraterritorial · Jamaica Data Protection Act 2020 - Scope + Application + Sections 1-3 + Commencement 1 December 2021 Partial + 1 December 2023 Mandatory Compliance + Territorial + Extraterritorial Application + Definitions →

The Act covers processing that happens wholly or partly in Sri Lanka, and processing by a controller or processor that is domiciled or ordinarily resident in Sri Lanka, is incorporated or established under Sri Lankan law, offers goods or services to (including...

sri-lanka-personal-data-protection-act-no-9-of-2022::s2 · Section 2: Territorial and extraterritorial application →

Georgia DPL Scope + applicability + 2023 GDPR-aligned amendments. SCOPE: applies to natural-person personal data processing in Georgia + (post-2023 amendments) EXTRATERRITORIAL APPLICATION to processing related to offering of goods or services to data subjects...

GeDPL-Scope-Defs-2023Amendments · Scope, Applicability, Definitions and 2023 GDPR-Alignment Amendments →

Directions 14-17 establish the cooperation regime + enforcement framework. Direction 14: When required by CERT-In + service providers + intermediaries + data centres + body corporates + government organisations shall provide information sought + take such acti...

CERTIN-Compliance-Cooperation-CERTInOrders-Penalties-Applicability-Dir14to17-Section44-IT-Act · CERT-In Directions 14-17 Compliance and Cooperation - Mandatory Cooperation with CERT-In + Information Requests + Action Directives + Applicability + Penalties for Non-Compliance + Sec 44 + Sec 70B(7) IT Act →

Questions people ask about extraterritorial application

What is Extraterritorial Application?
The application of privacy laws beyond a country's borders to foreign organizations that process the personal data of that country's residents.
Why is Extraterritorial Application important for compliance?
Extraterritorial Application is a key concept in Privacy and Data Protection. Understanding extraterritorial application helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Extraterritorial Application?
Extraterritorial Application appears in the requirement text of India DPDP Act, Indonesia PDP Law, Jamaica Data Protection Act 2020, Sri Lanka Personal Data Protection Act (No. 9 of 2022), Georgia Law on Personal Data Protection (2012). Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Extraterritorial Application?
Explore our compliance framework pages to see how extraterritorial application applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Extraterritorial Application applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Written and maintained by Gerard Blokdyk, The Art of Service.